Updating field permissions on profile metadata file causes them to disappear from file upon save

Question

I've created a custom profile for SF admins in our org. There are fields on every object that the profile doesn't have read access to because of field level security.

Rather than going through the profile editing UI on SF and changing field permissions on each object, I thought I'd download the profile metadata using my IDE (mavensmate on sublime), and just edit the field permissions.

the *.profile metadata includes a bunch of different tag categories, such as

<classAccesses>
<fieldPermissions>
<objectPermissions>
<recordTypeVisibilities>

etc.

A typical fieldPermissions entry looks like this:

<fieldPermissions>
    <editable>false</editable>
    <field>Contract.Contract_End_Date_New__c</field>
    <readable>false</readable>
</fieldPermissions>

That 'readable' attribute is unique to the fieldPermissions category, so I figured I could do a 'search and replace all' and replace all instances of <readable>false</readable> with <readable>true</readable>.

When I attempted to save my changes directly into production, the profile seemed to save successfully.. but when I pulled the metadata file again, all tag categories had disappeared from the metadata file except the <userPermissions> category! There was no metadata on field permissions, object permissions, anything.

And the wierd thing was that those permissions were still correct and visible via the profile UI - it's disappeared from the metadata but it still seems to be retained by the system!

Anyone have any idea what's going on here?

Answer 1

There is an exceptional default behavior of Metadata Type Profile:

It does not retrieve permissions which have false value in it.

In your case you are doing the same, you are setting the permission false and it would disappear from the profile then.

One more exception:

Profile permissions like field, custom object, Apex classes etc only retrieved if those associated metadata types are also part of same payload request. So, you need to retrieve custom object with profile to get that custom object permission in profile xml.