41
Turns out it's very easy:
PermissionSetAssignment psa = new PermissionSetAssignment
(PermissionSetId = myPermissionSetId, AssigneeId = myAssigneeId);
insert psa;
31
You can easily check all of your profiles by clicking on "Your Name" > Developer Console > Query Editor, and using the following query:
SELECT Profile.Name, PermissionSet.Label FROM PermissionSet WHERE PermissionsModifyAllData = true
If you see any unexpected profiles there, you can try copying the profiles back from a Sandbox, if you have one available. ...
23
This question is marked as unanswered, despite it was answered in the comments.
Let's revise the answer here:
PermissionSet ps = [SELECT Id FROM PermissionSet WHERE Name = '<required permission set name'];
insert new PermissionSetAssignment(AssigneeId = opUser.id, PermissionSetId = ps.Id);
16
From Salesforce Trust @ 5/17 12:56 pm:
The Salesforce Technology team is investigating an issue impacting Salesforce customers who use Pardot, or have used Pardot in the past. The deployment of a database script resulted in granting users broader data access than intended. To protect our customers, we have blocked access to all instances that contain ...
15
What permission sets allow you to do is minimize the number of profiles that you have to create. It also allows you to temporarily add and remove permissions for users without needing to change their entire profile. In that sense it's a huge time saver. They help keep your org's profiles simpler and your org "cleaner". There always tend to be "exceptions to ...
14
As far as i know anything you can do w permission sets you can do w profiles, but there are a few things that can as of now only be done w profiles.
The key UI difference in my experience is that only profiles can be used to control page layout assignment.
I took a look and at a top level, it looks like the following items are profile only. There may be ...
13
that's a lot of questions!
1) No, you don't need to enable test class access permissions for users
2) Controllers and their extensions do need to be assigned by permissions (https://help.salesforce.com/HTViewHelpDoc?id=users_profiles_apex_access.htm&language=en_US&release=180.7)
3) No, all classes required by a class to which a user has permission ...
9
We get this error when we are trying to perform DML on setup and non-setup objects in the same transaction.
Try to use System.runAs() in your test class code
Try to use this code:
System.runAs(new User(Id = Userinfo.getUserId())) {
PermissionSet ps = [SELECT Id FROM PermissionSet WHERE Name = 'Provenance_Description_Ownership'];
...
9
Adam Torman's answer to a somewhat related (but not entirely) question notes:
We do intentionally block the setting of parent permissions if it's a standard object
By granting any access to a custom object that is M/D to a standard object, that necessitates giving access to that standard object as well.
Managed package permission sets can't grant any ...
8
How PermissionSet relates to User is illustrated in this User, Sharing, and Permission Objects ERD.
So for example, this SOQL will list all permission set assignments:
select Assignee.Name, PermissionSet.Name
from PermissionSetAssignment
order by Assignee.Name, PermissionSet.Name
and this will list permission sets for a specific user:
select ...
8
There is an easy way to determine if field is a real field or a part of compound field.
There are two tables in Salesforce which correspond to compound fields and its components.
If a field can be found in FieldDefinition table, it is a real (permissionable) field. If a field cannot be found in FieldDefinition table, but can be found in EntityParticle ...
8
Profiles are replicated into a special type of PermissionSet. IsOwnedByProfile will be true, ProfileId will be set to the Profile's Id field. So, you can query PermissionSet to determine a profile's object, field, apex class, and Visualforce permissions via the associated security objects (e.g. ObjectPermissions). Also, see the User Access Visualization open ...
8
As of 3 PM CDT.
This is something I got to hear around from my colleagues who were part of the webinar that Salesforce had around this issue.
The issue seemed to have affected DR sites as well, so rollback seems difficult
Access to other Orgs were restricted as a precaution for the initial issue which impacted Sandboxes too (even if they never had Pardot ...
7
I encountered same issue. And the solution which worked for me was that while creating the permission set I was not selecting any User License in the picklist. I created a new permission set with User License as 'Salesforce' and then option for Tab settings in opportunity object became enabled.
May be this could help.
7
You can use userRecordAccess object to check CRUD permissions..
So pass the recordId and userId.. to check that user having what type of access on that record..
you can check variables like HasDeleteAccess. If HasDeleteAccess true means user have delete access. If false then user don't have access..
Based on these accessibility perform DML..
List<...
7
By fully retrieving all permissions all the time, it will avoid the various Bad Things that happen when you only retrieve a partial package. This would lead to the XML file spuriously growing very large/small simply based on how the tool you're using decided to retrieve your org's metadata (e.g. a partial retrieve would result in a partial permission set, ...
7
In short: I managed to do this in Apex by using apex-mdapi AFTER I updated the code to support flowAccesses. - here's the github commit with changes needed to support it. This is the only way I can see to do this through Apex as you need to hit the Metadata API.
Very Long Version
I didn't see anything within SOQL or Tooling API that can be used. It seems ...
6
Force.com IDE
Sometimes, you can still login with the Force.com IDE. It doesn't hurt to try. If you can, you can then download the admin profile, update the settings, and you'll be good to go. Make sure you're logging in from inside the corporate network or another location listed on your Network Access list.
Premier Support
If you have Premier Support, ...
6
The Rule of thumb is permission set extend the access of profile and do not restrict.
1.In first scenario since profile already has access which means permission set cannot disable as permission sets are meant to extend the behaviour
2.Second case its obvious .
If you want to restrict the behaviour for a user ,then disable at profile and do not assign ...
answered Jul 13 '16 at 3:28
Mohith Shrivastava
75.4k12 gold badges124 silver badges169 bronze badges
6
You need to give access to visualforce page only. As per the docs:
Once users can access a page, they can execute all Apex that’s associated with the page. This includes:
The controller for the page and any Apex classes called from the controller class.
Any extension classes for the page and any Apex called from an extension.
Any Apex classes associated ...
6
You can check this link
http://hellosnl.blogspot.com/2017/08/salesforce-security-concepts.html
Also check this image
6
Permission sets are not used to prevent access to fields, to do that go to the profiles for the relevant users and untick access on there.
Then use the Permission Sets to give access to the other fields to the users that need to see them.
Permission Sets - Salesforce Help
6
I had this same issue. I even logged a case with Salesforce about it because it wasn't straightforward.
It occurs when the sysadmin profile has a default record type of Master (for the object) when there is a custom record type.
6
As stated in the SOAP API Documentation
FieldPermissions : Represents the enabled field permissions for
the parent PermissionSet. This object is available in API version 24.0
and later.
So when querying the FieldPermissions object you'll only get the enabled permissions
Possible solution
1- You should query the list of all fields of an SObject with ...
6
As mentioned by @benahm, SOQL on FieldPermissions retrieves only enabled field permissions for the permission set.
Furthermore, as per chapter "Special Properties for Field Permissions" in documentation here, fields that are always readable and/or writable, don’t return a FieldPermissions record.
Note that getDescribe methods can also be accessed via REST ...
6
While I was composing this question I figured it out.
Since it took me longer to figure out than I would have liked, I will share what I learned in case it helps someone else down the road.
It turns out that the connection between CustomPermission and the PermissionSet is made via the object called SetupEntityAccess.
You can look up if a custom ...
6
It was not really clear from the announcement or from most of the documentation, but Salesforce Data Mask is actually a paid feature, and if you want to use it you need to talk to your Account Execute to purchase licenses.
As per the documentation on installing Salesforce Data Mask:
Ensure that your organization has the Data Mask User permission set ...
5
Should I replace Feature toggles in Custom Settings with Custom Permissions ?
It depends on the setting. If a user can toggle the feature, it's a preference (custom setting). If it relates to a feature permission, it's probably a custom permission.
Should I have a permission set per User Story or Functional block?
One per feature. For example, a credit ...
5
I could find the VF tab in the Object Settings .Its confusing that Tab settings are mixed with Object Settings .
My sample VF tab showed up
Here is the Settings
answered May 8 '16 at 18:20
Mohith Shrivastava
75.4k12 gold badges124 silver badges169 bronze badges
5
AFAIK the platform has no direct support for this.
But you can write workflow logic or trigger code to add/delete the PermissionSetAssignment objects automatically based on attributes of the User including the Profile or custom fields that you add. The relevant part of the data model is included below (from the Profile and Permission Objects documentation). ...
Only top voted, non community-wiki answers of a minimum length are eligible
