3

I have a trigger/classes in place that follows a record for a Community user. I am doing this by inserting a new EntitySubscription record. My code is working great for Admin users. However, when a non-admin user initiates the trigger/class, I receive the error:

System.DmlException: Insert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id

I believe the root cause of this error is limitations on the EntitySubscription object. From the official documentation:

Administrators and users with the “Modify All Users” permission can configure a user to follow records that the user has read access to.

I take this to mean that users cannot follow records for other users, unless they have the “Modify All Users” permission, which would explain the error I am seeing.

Has anyone ran into this issue before or have any workarounds for this? Thanks in advance for your assistance.

| improve this question | |
3

So you want the trigger to execute successfully regardless of user type? Remove "with sharing" from the classes. Triggers will run in system context if your trigger and classes the trigger calls aren't marked as "with sharing."

http://www.tgerm.com/2011/03/trigger-insufficient-access-cross.html

| improve this answer | |
  • I do not have "with sharing" in my class. Here are the first lines: public class CC_BuyerCreationHelper { public static void createBuyers(Set<Id> updatedSaleIds) { – John_Henry Jul 10 '15 at 16:53
  • Are any of the classes being called marked as such? AFAIK (calling Adrian or sfdcfox to correct me here), the only time permissions are enforced from within a trigger context is if the trigger or any executed classes are marked as such – Brian Mansfield Jul 10 '15 at 16:56
  • You may be right..just took a closer look and the trigger is calling another class before the one I referenced. I'll try removing that and give it a try. – John_Henry Jul 10 '15 at 17:05
  • Well partial success, removing "with sharing" from the other class and the trigger itself allowed the trigger/class to complete without error. However, the record itself is still not followed by the Community user. – John_Henry Jul 10 '15 at 20:13
  • When inserting the EntitySubscription record, is the NetworkId field being set to the community's network ID? – alouie Jul 13 '15 at 6:59
1

Not only did I need to remove the "with sharing" keyword from all classes called via my trigger, I needed to add the "without sharing" keyword. Once this was in place I was able to resolve the issue.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.