4

My team and I are working on a project together using Lightning components and a lightning app. Each one of us have our own Salesforce developer edition orgs. We use "Force CLI" to fetch the code to our local enviroments and update our orgs. We use SVN to keep our locals sync.

The difficult that we are facing is about objects. We need to have the same objects on our own orgs and same data. Currently we are using "Force CLI" to fetch and update the objects, and Apexdataloader to Export and Insert the data.

This method works, but for each object that we update to our orgs we need to change the Field-Level Security to Visible for each field of each object. The bigger our schema gets the more tedious and time consuming this task gets.

I was wondering if is there a way to export objects with their Field-Level Security. If not, is there a way to set all fields at once?

1
  • Do you need the settings changed for all users or on a profile by profile basis? All objects or one at a time? Commented Sep 11, 2015 at 0:14

3 Answers 3

2

Using the FORCE CLI with Sublime Text 3 method, whenever you fetch metadata for custom objects, it returns you with a CustomObjectName__c.object file, which is an XML interpretation of the object, containing all of the settings and custom fields for that object. This method doesn't allow for custom field security settings to be added to that .object file.

Going on what @sfdcfox said earlier, you can modify any profile and add custom field permission sets to it. It works.

FORCE CLI with Sublime Text 3 Method:
Fetch the profile you would like to edit by doing Right Click > Lightning > Fetch > Metadata then select Profiles, next select the profile you wish to Fetch. Afterwords edit the profiles/Admin.profile file (or whichever one you fetched), and add the field permissions you need.

<fieldPermissions>
    <field>Custom_Object__c.Custom_Field__c</field>
    <editable>true</editable>
    <readable>true</readable>
    <hidden>false</hidden>
</fieldPermissions>

You can repeat it as many times as you want:

<fieldPermissions>
    <field>Custom_Object_1__c.Custom_Field_1__c</field>
    <editable>true</editable>
    <readable>true</readable>
    <hidden>false</hidden>
</fieldPermissions>
<fieldPermissions>
    <field>Custom_Object_1__c.Custom_Field_2__c</field>
    <editable>true</editable>
    <readable>true</readable>
    <hidden>false</hidden>
</fieldPermissions>
<fieldPermissions>
    <field>Custom_Object_1__c.Custom_Field_3__c</field>
    <editable>true</editable>
    <readable>true</readable>
    <hidden>false</hidden>
</fieldPermissions>
<fieldPermissions>
    <field>Custom_Object_2__c.Custom_Field_5__c</field>
    <editable>true</editable>
    <readable>true</readable>
    <hidden>false</hidden>
</fieldPermissions>

You must remember that this method is only a way of updating the permissions, meaning if you remove these field permissions from this file and save once again, it won't update any permissions, since they have already been set to true / false as per your last deployment. However, if you would like to change a field permission to false simply turn the true value to false and deploy.

<fieldPermissions>
    <field>Custom_Object_2__c.Custom_Field_5__c</field>
    <editable>false</editable>
    <readable>false</readable>
</fieldPermissions>

There are other types of permissions you can provide to the Profiles or the PermissionSets (if you import these instead via FORCE Cli in Sublime). Read more about them here Metadata API Developer’s Guide - PermissionSets.

Hope this helps,
Happy Coding!


EDIT

Thanks for the reply @Jason Lantz. Writing up an ANT Script to do just this was going to be my task for later tonight. Thanks for writing one!

If a dev team is already used to the quick Save and Update feature of FORCE CLI and Sublime, they will be hesitant for waiting in line for the extra seconds it takes the ANT script to deploy the changes to their files. I know we'll be using this method in the future to deploy working code to the production SF ORG.

3

Using any tool that supports exporting the metadata, such as Force.com IDE, export the fields you want to inspect and all profiles you want to modify. The profile xml files will contain the field security for each field that was exported. From there, you can fairly easily set whatever security values you like, then save back to the server. If your tool of choice has a multi-line regexp search-and-replace function, you could quickly change a single field's security in mere seconds for hundreds of profiles. Alternatively, you can globally search and replace all editable/readable values at once.

1

Funny timing, I literally just coded up an ant target to do exactly this on the Admin profile for an org.

https://github.com/SalesforceFoundation/CumulusCI/compare/580674ce13892f6251859d92c397c814aa87add6...master

You can either port the target to your own build scripts or just use ours:

git clone https://github.com/SalesforceFoundation/CumulusCI
export CUMULUSCI_PATH=`pwd`/CumulusCI
cd YOUR_PROJECT_FOLDER
cp $CUMULUSCI_PATH/template/* .

Then you'll want to edit the cumulusci.properties to fill in the appropriate values for your project. You'll also need to create a build.properties file in the root of your project with sf.username, sf.password (pass+token), and sf.serverurl defined.

Once that's done, you can run the target:

ant deployUpdatedAdminProfile

The thing I learned in the process is that when you retrieve the Profile, you have to also retrieve all objects you want to set FLS for. When you update the retrieved Profile locally and want to deploy it back, you have to deploy the profile with all the objects you retrieved originally.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .