Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

validate callout payload at webservice? [on hold]

I am making a callout to web service. How can i validate payload received from callout at web service endpoint. is there anyway to authenticate that request actually came from salesforce only?
3
votes
1answer
56 views

Marketing Cloud - callout from CloudPage to MC API - where to store credentials

We are building a simple functionality on a CloudPage that will be making an API call to Marketing Clouds API. I was looking at documentation to find information on where we should store the Client Id ...
4
votes
3answers
2k views

Can I Mass Modify Object Settings > Tab Settings for All Profiles? (Default On/Default Off/Hidden)

I am in the process of my first Salesforce deployment to Production (my company has been working with an implementation team for 7 months or so, and we are going live on Monday). We had some security ...
2
votes
1answer
25 views

Field level Security Or Profile permission edit not working!

On a "section" of the Opportunity Object I am trying to give "read only" to a specific profiles or specific user however when I go to profile I am unable to edit profile permission of the object I am ...
0
votes
1answer
13 views

Different QuoteDocument using Connected APP REST API and Workbench / Interaction

I've set up a autolaunched Flow, which creates a PDF based on a Quote Template. My connected APP use this Flow through the REST-API. The output is an empty PDF with a Size of 2 KB. The same Flow, ...
1
vote
0answers
20 views

Providing a list of data to non-users securely [closed]

We have a requirement to send data to a list of people who are not users. This data is, and should be treated as, highly secure. These people are owed this data and are allowed to view it but it ...
0
votes
1answer
20 views

Community Plus users are not able to get the attachment using standard salesforce API

We want to get attachment BLOB data using the standard salesforce API. See the API Docs link below. ([https://developer.salesforce.com/docs/api-explorer/sobject/Attachment/get-attachment-id]) We are ...
2
votes
1answer
40 views

Constructing a SSL certificate chain for uploading to Certificate and Key Management

Background I generated a CSR from Salesforce setup and have received back the PositiveSSL Certificate from sectigo.com. But when I try and upload the certificate into Salesforce, I get this error: ...
2
votes
0answers
24 views

Schema.sObjectType.Task.fields.Subject.isUpdateable() is false in force.com site

We have managed a package where we are using apexrest through force.com site to update the task records. This works fine unless we add security enforce through apex getDescribe() like, Schema....
0
votes
1answer
18 views

can you restrict edit access to a field after one time edited?

I am working on a Picklist requirement which needs to give Edit access to all by default. Once any value is entered by any user, edit access is restricted to all except Admin Profiles. Any ...
3
votes
1answer
473 views

Solution to Tokenized Sending limitations in Salesforce Marketing Cloud(SFMC)

So our Prospect want to implement Tokenized Sending Features because they don't want to store data in SFMC before sending Email/SMS and want to use REST API to push data into SFMC but again they want ...
0
votes
1answer
19 views

Make a User only view and manage users in setup - Nothing else

Is there a way - setting to say that a user will only manage users (view, create and update users) from setup and nothing else? For example, i don't want this user to have access to object manager ...
2
votes
1answer
30 views

What are the security implications of using a self signed certificate for the JWT-Based Auth flow or to authorize a connected app in Salesforce?

I am new to Salesforce DX and am in the process of setting up a scratch org. The steps on Salesforce's website instruct the user to create a self-signed certificate because "The JWT-based ...
2
votes
1answer
545 views

Adding members to Account Team

OWD for Account /Opportunity and cases are private. I have formed a group in the organisation which includes only post sales consultant. The members of the group should have the flexibility to add ...
0
votes
1answer
9 views

Limit records based upon multiple criteria on object and user

I'm looking at limiting access to certain records such that should a record be assigned to a certain group of users (via some field on the object), only those users would be able see or edit those ...
1
vote
1answer
17 views

Field Level Security on Email Template Not Working as Expected

I'm trying to hide specific fields in an email template for a specific profile. For this, I removed the field level access for fields I want to hide for the respective profile. After logging in as ...
10
votes
3answers
4k views

What are permissions are needed to upload a file via a public Salesforce community page?

I would like to be able to upload files using <lightning:fileUpload which is on a public community page. The community is using template: Customer Account Portal. The files would get attached to ...
3
votes
1answer
40 views

How to check from Apex code if custom setting is protected?

The question is simple: Is there any way to figure out from Apex code if custom settings is marked as protected or not? Looking through DescribeSObjectResult cannot find any single method related to ...
0
votes
2answers
341 views

Data loader on custom object, Object ID not available in field mapping

Colleague has the same 'Admin' profile as me. If I try to update data via the data loader I see all fields, if he tries he can not see the custom object id but can access the object? Note this is ...
0
votes
0answers
14 views

owner change in case with child record relationship master detail

I am changing the owner of the case and I have a master-detail with viewed notification object.everything is working fine .the problem is in changing the owner of the case does not transfer the viewed ...
0
votes
3answers
56 views

Possible to Detect if a Record is Being Created by Apex?

Background An Apex Trigger has been set up on a parent object to automatically create a child object record when the parent object record is created. However, another Apex Trigger has been set up on ...
0
votes
0answers
23 views

Access Granted Through Sharing Rules is Inconsistent - Keep Having to Recalculate

We're having a problem where we are continuously having to manually recalculate sharing rules in an org. Account OWD is set to Private. Sharing Rule 1: Account lookup field is populated by a certain ...
0
votes
0answers
10 views

Using PKCE while integrating salesforce with an authorization server [duplicate]

I want to authenticate users for salesforce community with external authentication server. I want to use PKCE to secure this. Has anyone implemented this? How to create code_verifier and ...
0
votes
1answer
75 views

Can emails from Marketing Cloud be sent via a relay?

The CSO of my company doesn't want us to use Marketing Cloud to employees unless the emails are sent through a relay ("...it needs to be authenticated and secured (and must have protections to prevent ...
0
votes
1answer
18 views

Possible to Customise Groups?

It it possible to: 1) Add new Type values for Groups? This is a picklist field. 2) Customise the page layout for Public Groups? 3) Create a text field for (Public) Groups? The Group object doesn't ...
0
votes
1answer
633 views

Using without sharing with customer community - can't create account

It looks like customer community users can't create Account records because there is no create option in object settings for a customer community profile. I thought that I could get around this if ...
5
votes
1answer
715 views

Why do force.com sites domains have secure in the domain and some don't?

In our production org, force.com sites have two endpoints listed https://<ourdomain>.secure.force.com http://<ourdomain>.force.com It seems that these URLs can be used interchangeably ...
2
votes
1answer
87 views

Edit Permissions for Guest Users after “Secure guest user record access”

Salesforce Alerted me that at the end of February we would be forced into the security update for "Secure guest user record access". I tried this in my sandbox and it seems to have some adverse ...
0
votes
1answer
38 views

Marketing Cloud sFTP to vendor issue

We are trying to use Marketing Cloud to drop a file onto a vendors sFTP site. We have username and password etc and can make the connection from home, Starbucks or any network except where we work. ...
0
votes
0answers
16 views

Mask Data Based on Opportunity Team

I am wondering the approach to take on this.. The requirement is to have a certain opportunity type where the data is masked to everyone except the members of the opportunity team... We are thinking ...
2
votes
1answer
36 views

Why can't I look at 'individual' relationship on contact/lead?

In order to comply with GDPR rules and regulations, I've enabled the 'Individual' object in our org to store individual's privacy preferences. Our main use case is to prevent any type of Data Loader ...
0
votes
0answers
8 views

Hide lead records from global search and list view including system admin

I have implemented lead conversion from apex class. I have done that correctly. But after the conversion I want to archive the lead(Hide the lead from list view). In standard lead conversion ...
4
votes
1answer
59 views

Does Salesforce support PKCE validation in Web server flow?

In Salesforce OAuth2.0 Web Server flow, there is an option to not require a client key. But I am not sure whether it supports OAuth 2.0 RFC 7636: https://oauth.net/2/pkce/, which is the PKCE ...
2
votes
0answers
23 views

Transaction Security is not available in Scratch Org

How am I able to turn on the visibility for transaction security? I am trying to test an apex class that implements TxnSecurity.PolicyCondition and according to this article to be able to see these ...
4
votes
1answer
61 views

Is it possible to upload a self-signed certificate into Salesforce for callout purpose?

We need to make a callout to an external system. The external system uses a self-generated certificate to verify the caller. So is it possible to upload a certificate into Salesforce for this purpose? ...
0
votes
1answer
406 views

Unable to Add quote line items : facing error insufficient priviledges

I am getting error "insufficient priviledeges while adding quote line item. Checked with permission setting for profile but still same. i have access to quote object. Got to the one point, when we ...
0
votes
0answers
33 views

I have a problem with the data security supeadgr challenge

I set the profile several times but still continues with the error step 4 (Challenge Not yet complete... here's what's wrong: The Field Sales User profile does not have the correct permissions for ...
1
vote
2answers
55 views

Mask sensitive data in production

Is anyone aware of how to mask sensitive data within the GUI? I have seen some mention in Sandboxes,but wanted to see if anyone was doing this in production? Thanks!
1
vote
1answer
23 views

Parameter validation in Visualforce to prevent “Illegal Request”

I have a very simple public force.com site (lets use the subdirectory mypublicsite), that accepts a single parameter. Since the site is public, users may send malicous content through this parameter. ...
1
vote
2answers
50 views

External Object to make only subset of records from mysql table available for SF org

We have a rather typical requirement at a first glance - just to make bunch of records from external mysql database available in clients' sf orgs. And we are giving a short to SF External Object as an ...
0
votes
0answers
15 views

Salesforce community and sharing - why are community accounts shared with all internal users of the same role and below?

We have a Salesforce community implementation and at the same time do not have a concept of role hierarchy in our org. Right now all internal users have the same role, "Sales User". Up until now, ...
0
votes
1answer
35 views

Can Remote Site Settings whitelist IP addresses instead of/in addition to domains?

I'm just wondering: We make a number of callouts from Salesforce to different APIs, and so obviously we need to whitelist their respective domains with Remote Site Settings. However, I'm wondering ...
1
vote
2answers
1k views

Restricting record level access in role hierarchy

If i set the OWD for Account as private and if i create a public group and add some users into that and create a sharing rule for giving read and write access to that public group then managers of the ...
8
votes
1answer
10k views

Why do I get 'PKIX path building failed' exception with my callout?

Error message :PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Hello all please see the above ...
1
vote
1answer
1k views

Blocked by CORS policy: No 'Access-Control-Allow-Origin' header on the requested resource

I am trying to use a Google Charting library inside a Lightning Aura Component. Component <aura:component implements="flexipage:availableForAllPageTypes"> <ltng:require scripts="{!$...
76
votes
7answers
12k views

Apex static code analysis

What static code analysis tools are there for apex? The only one I seem to be able to find is the Force.com Security Source Code Scanner but that has the draw back of placing your request into a queue ...
2
votes
1answer
468 views

Permission Sets on Quotes Template

I would like to create a permission set to give an access to all quote templates. I do not want some users within the same profile to see or have access to the quotes template. How to user can only ...
0
votes
1answer
24 views

IP restrictions when authenticating named credentials

I'm trying to create a named credential for accessing in-house services from salesforce. For that I've setup an authentication provider: type: Open ID Connect Authorize Endpoint URL: https://test....
0
votes
1answer
452 views

How to export profile password policy (Summer ’17)?

According to Salesforce Summer ’17 Release Notes it should now be possible to export the Password Policies per profile settings (see quote below). Has anyone managed to achieve that? If so can you ...
4
votes
1answer
57 views

Determine whether running user is logged in from within Trusted IP Range (from Apex)

I am creating a Login Flow that invokes Apex to do some processing, and need to determine whether the running (logging-in) user is connecting from an IP address whitelisted in our org's Trusted IP ...