Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

Using PKCE while integrating salesforce with an authorization server [duplicate]

I want to authenticate users for salesforce community with external authentication server. I want to use PKCE to secure this. Has anyone implemented this? How to create code_verifier and ...
0
votes
1answer
262 views

Can emails from Marketing Cloud be sent via a relay?

The CSO of my company doesn't want us to use Marketing Cloud to employees unless the emails are sent through a relay ("...it needs to be authenticated and secured (and must have protections to prevent ...
0
votes
1answer
19 views

Possible to Customise Groups?

It it possible to: 1) Add new Type values for Groups? This is a picklist field. 2) Customise the page layout for Public Groups? 3) Create a text field for (Public) Groups? The Group object doesn't ...
2
votes
1answer
795 views

Edit Permissions for Guest Users after “Secure guest user record access”

Salesforce Alerted me that at the end of February we would be forced into the security update for "Secure guest user record access". I tried this in my sandbox and it seems to have some adverse ...
0
votes
1answer
76 views

Marketing Cloud sFTP to vendor issue

We are trying to use Marketing Cloud to drop a file onto a vendors sFTP site. We have username and password etc and can make the connection from home, Starbucks or any network except where we work. ...
0
votes
0answers
16 views

Mask Data Based on Opportunity Team

I am wondering the approach to take on this.. The requirement is to have a certain opportunity type where the data is masked to everyone except the members of the opportunity team... We are thinking ...
2
votes
1answer
40 views

Why can't I look at 'individual' relationship on contact/lead?

In order to comply with GDPR rules and regulations, I've enabled the 'Individual' object in our org to store individual's privacy preferences. Our main use case is to prevent any type of Data Loader ...
0
votes
0answers
10 views

Hide lead records from global search and list view including system admin

I have implemented lead conversion from apex class. I have done that correctly. But after the conversion I want to archive the lead(Hide the lead from list view). In standard lead conversion ...
4
votes
1answer
198 views

Does Salesforce support PKCE validation in Web server flow?

In Salesforce OAuth2.0 Web Server flow, there is an option to not require a client key. But I am not sure whether it supports OAuth 2.0 RFC 7636: https://oauth.net/2/pkce/, which is the PKCE ...
3
votes
1answer
49 views

Transaction Security is not available in Scratch Org

How am I able to turn on the visibility for transaction security? I am trying to test an apex class that implements TxnSecurity.PolicyCondition and according to this article to be able to see these ...
4
votes
1answer
103 views

Is it possible to upload a self-signed certificate into Salesforce for callout purpose?

We need to make a callout to an external system. The external system uses a self-generated certificate to verify the caller. So is it possible to upload a certificate into Salesforce for this purpose? ...
0
votes
1answer
365 views

I have a problem with the data security supeadgr challenge

I set the profile several times but still continues with the error step 4 (Challenge Not yet complete... here's what's wrong: The Field Sales User profile does not have the correct permissions for ...
1
vote
2answers
128 views

Mask sensitive data in production

Is anyone aware of how to mask sensitive data within the GUI? I have seen some mention in Sandboxes,but wanted to see if anyone was doing this in production? Thanks!
1
vote
1answer
23 views

Parameter validation in Visualforce to prevent “Illegal Request”

I have a very simple public force.com site (lets use the subdirectory mypublicsite), that accepts a single parameter. Since the site is public, users may send malicous content through this parameter. ...
1
vote
2answers
68 views

External Object to make only subset of records from mysql table available for SF org

We have a rather typical requirement at a first glance - just to make bunch of records from external mysql database available in clients' sf orgs. And we are giving a short to SF External Object as an ...
0
votes
0answers
20 views

Salesforce community and sharing - why are community accounts shared with all internal users of the same role and below?

We have a Salesforce community implementation and at the same time do not have a concept of role hierarchy in our org. Right now all internal users have the same role, "Sales User". Up until now, ...
0
votes
1answer
57 views

Can Remote Site Settings whitelist IP addresses instead of/in addition to domains?

I'm just wondering: We make a number of callouts from Salesforce to different APIs, and so obviously we need to whitelist their respective domains with Remote Site Settings. However, I'm wondering ...
0
votes
1answer
32 views

IP restrictions when authenticating named credentials

I'm trying to create a named credential for accessing in-house services from salesforce. For that I've setup an authentication provider: type: Open ID Connect Authorize Endpoint URL: https://test....
4
votes
1answer
82 views

Determine whether running user is logged in from within Trusted IP Range (from Apex)

I am creating a Login Flow that invokes Apex to do some processing, and need to determine whether the running (logging-in) user is connecting from an IP address whitelisted in our org's Trusted IP ...
0
votes
1answer
124 views

Is it advisable to use AMPscript as validation on a custom subscription center?

I have built a custom subscription center using SSJS and AMPscript and I was wondering if, beyond the fact that it works, if it's up to security standards. The center is just one cloud page which ...
0
votes
0answers
96 views

VisualForce Page - Detail Page Button - not displaying

I have a Detail Page Button on opportunity that open Visualforce page. From this Visual force page I can navigate through multiple Visualforce pages.That was working very well and without any changes ...
3
votes
0answers
63 views

Standard User with “Modify Metadata” fails to create active Picklist Value

What is failing here perfectly works for a SysAdmin user. I have a StandardUser with a permission set which grants him ModifyMetadata and calling this code creates the Picklist Value but leaves it ...
1
vote
1answer
56 views

Do you need Read access to an object to view its records in a report?

I believe if you have access to a report, record level access can be ignored and you can potentially see all records. Does this apply at the object level of a profile? So say a report is on Accounts, ...
0
votes
0answers
29 views

How exactly are the Einstein analystics external connectors secured?

I'm trying to connect einstein analytics to one of our local data servers. But network wont add the whitelist until they know how does this connection stay secure? And luckily for me not a single ...
0
votes
0answers
41 views

Can Code triggered by Chatter-Free user run in System mode?

I am exposing some code to Chatter Free user which modifies Account objects. I know that Chatter Free users are not directly able to modify them. But can my trigger code do it on behalf of them? As ...
-3
votes
1answer
68 views

Ability to the employee user to edit the records created by manager

I have 2 roles (Manager and Employee). Employee reports to Manager. Employees should be able to edit Case records created by manager. OWD on the Case object is Private. Created a criteria based ...
1
vote
1answer
32 views

Default Sandbox access situation with regards to users

So when a Sandbox is refreshed or created, everyone's email gets changed so that it has .invalid on the end. This seems to have the useful side effect of stopping users from logging in - when they ...
0
votes
0answers
53 views

How can I prevent unauthenticated users from downloading an attachment?

I have a community and internal links to attachments. They end with ...servlet/servlet.FileDownload?file={ID} When the user clicks the link, a window.open(fileUrl) is called. This prompts to download....
0
votes
0answers
66 views

How to hide records from Community users based on record type

I have requirement wherein i need to hide/show records from Community users based on record type i.e., Community Users should only see records of X object but only for the type of record type assigned ...
0
votes
0answers
62 views

View report records by queues not working

I have a custom report (Sales Orders with Work orders) but it doesn't filter out by queues. Both objects are on PRIVATE in the OWD and I have set the filter to the one in the print screen Any user ...
4
votes
1answer
104 views

Is Jest mandatory in LWC For appExchange app

As SF stated Jest is independent of Salesforce and doesn't run in web browser. Is it mandatory to write coverage/unit testing for Lightning Web Components and add in bundle while creating manage ...
0
votes
1answer
164 views

with sharing without sharing vs extension?

While going through manuals, it was mentioned Many times that apex classes will not consider security of logged in user but it will run in system mode and we should add custom controller extension to ...
0
votes
0answers
16 views

Security - See which user exported reports [duplicate]

Is there a way which I can know which user made export to report? Details about the user, date and time and the report name? (A free tool will be great). Thanks!
1
vote
0answers
26 views

How to secure API end points in custom activities?

I have a custom activity created for the journey builder. From a security point of view, how can I protect my REST endpoints? I know we can get the fuel token in the getToken method from postmonger. ...
1
vote
0answers
35 views

Using Protected Component for “Secret Protection” with Unlocked Packages

How do "Protected Components" (Custom Settings or Custom Metadata) function when installed from an Unlocked Package. I was hoping that I would be able to use as "Protected (Managed)" to store "...
0
votes
0answers
39 views

Need help on Salesforce Login discovery

Requirement-I want one of the dedicated profile to be redirected to seprate SSO flow and others needs to redirect to normal username/password flow. I have gone through Login discovery but it seems to ...
1
vote
2answers
91 views

How to temporarily Disable Access for Entire Org?

How to temporarily Disable Access for Entire Org? For all Internal and/or All External users.
1
vote
2answers
55 views

Remove password policies from profiles and have only one central password policy?

In our org, some profiles have their own password policy; these overwrite the general password policy. I would like to return to having only one centralized policy. How can I do that? I cannot find a ...
1
vote
0answers
337 views

CPQ - twin fields not working for certain profiles due to security setting

We are building a twin field in quote and order in the hope that the field value can be automatically copied into order. This is working for other profiles but not sales user since they don't have ...
0
votes
1answer
203 views

Update failed. INSUFFICIENT_ACCESS_OR_READONLY, You do not have the level of access necessary to perform the operation you requested

Background I have created a custom upload component based on this but using ContentVersion rather than Attachment. This custom upload component is being used on a public community page and has an ...
2
votes
1answer
184 views

How do guest communities allow access to detail pages?

Do communities evaluate the Record requested when determining if a page should be accessible? So we have a guest community, which we share some accounts to, for varying purposes. For some childA and ...
0
votes
1answer
41 views

Able To Delete Sobject Even if No permission for User

I have an Invoice Object inovice1, A profile sales1.Profile sales1 have no crud permission for invoice1 object not even read. Also OWD for Invoice object is set to private.Still I am able to insert,...
4
votes
1answer
109 views

Security Question AuraEnabled Dynamic SOQL

Let's say I have an Apex Class like this: public with sharing class AuraUtils { @AuraEnabled(cacheable=true) public static List<SObject> databaseQuery(String queryString){ List<SObject&...
0
votes
1answer
215 views

JWT Bearer flow vs. Username+Password flow in server-to-server integration

Official documentation and some SFSE answers advise against the use of Username + Password flow (Resource Owner Password Credentials Grant in oauth). The JWT Bearer flow is also recommended as a ...
1
vote
1answer
137 views

Sharing of a junction object

What access would a junction object have if one master object has read-write access while the other master object has read access through the sharing rules with organization-wide defaults private for ...
0
votes
0answers
134 views

Can we give user permission to add Notes & Attachments even user's profile has Read only for that object

I have a below setting for the object. ORG wide defaults- Private User's Profile - Read, View All Can I have user to add notes and attachments despite the fact he can't edit object. Thanks
4
votes
0answers
23 views

Calling the UI Api from a community with a custom domain name - getting sun.validator exception [duplicate]

Context: we're using the UI api to get some Record Type dependent picklist values back. This is happening in a community context. In the lower environments (dev, QA) this works without issue. The ...
2
votes
1answer
43 views

Custom Meta Data - Hacking security

Is it secure to set as custom meta data, for example, Credit card details or any other sensitive data? Is there any existing option to encrypt this data ?
0
votes
1answer
332 views

Getting error while adding a trusted site

I am adding some markup in "Head Markup" section of Community Builder(Settings --> Advanced) that references resources from 3rd party websites. Thus, SFDC gives me CSP violation warning in the markup. ...
0
votes
0answers
37 views

Uploading CA-Signed CRT to Salesforce?

I have an existing CA-Signed Certificate (CRT) given to me by my client, and it is needed to be able to make callouts to their external system. I have not found a way to be able to upload a CRT to ...

1
2
3 4 5
14