36
Turns out it's very easy:
PermissionSetAssignment psa = new PermissionSetAssignment
(PermissionSetId = myPermissionSetId, AssigneeId = myAssigneeId);
insert psa;
30
You can easily check all of your profiles by clicking on "Your Name" > Developer Console > Query Editor, and using the following query:
SELECT Profile.Name, PermissionSet.Label FROM PermissionSet WHERE PermissionsModifyAllData = true
If you see any unexpected profiles there, you can try copying the profiles back from a Sandbox, if you have one available. ...
16
This question is marked as unanswered, despite it was answered in the comments.
Let's revise the answer here:
PermissionSet ps = [SELECT Id FROM PermissionSet WHERE Name = '<required permission set name'];
insert new PermissionSetAssignment(AssigneeId = opUser.id, PermissionSetId = ps.Id);
15
From Salesforce Trust @ 5/17 12:56 pm:
The Salesforce Technology team is investigating an issue impacting Salesforce customers who use Pardot, or have used Pardot in the past. The deployment of a database script resulted in granting users broader data access than intended. To protect our customers, we have blocked access to all instances that contain ...
13
that's a lot of questions!
1) No, you don't need to enable test class access permissions for users
2) Controllers and their extensions do need to be assigned by permissions (https://help.salesforce.com/HTViewHelpDoc?id=users_profiles_apex_access.htm&language=en_US&release=180.7)
3) No, all classes required by a class to which a user has permission ...
12
What permission sets allow you to do is minimize the number of profiles that you have to create. It also allows you to temporarily add and remove permissions for users without needing to change their entire profile. In that sense it's a huge time saver. They help keep your org's profiles simpler and your org "cleaner". There always tend to be "exceptions to ...
10
As far as i know anything you can do w permission sets you can do w profiles, but there are a few things that can as of now only be done w profiles.
The key UI difference in my experience is that only profiles can be used to control page layout assignment.
I took a look and at a top level, it looks like the following items are profile only. There may be ...
9
We get this error when we are trying to perform DML on setup and non-setup objects in the same transaction.
Try to use System.runAs() in your test class code
Try to use this code:
System.runAs(new User(Id = Userinfo.getUserId())) {
PermissionSet ps = [SELECT Id FROM PermissionSet WHERE Name = 'Provenance_Description_Ownership'];
...
8
How PermissionSet relates to User is illustrated in this User, Sharing, and Permission Objects ERD.
So for example, this SOQL will list all permission set assignments:
select Assignee.Name, PermissionSet.Name
from PermissionSetAssignment
order by Assignee.Name, PermissionSet.Name
and this will list permission sets for a specific user:
select ...
8
As of 3 PM CDT.
This is something I got to hear around from my colleagues who were part of the webinar that Salesforce had around this issue.
The issue seemed to have affected DR sites as well, so rollback seems difficult
Access to other Orgs were restricted as a precaution for the initial issue which impacted Sandboxes too (even if they never had Pardot ...
7
You can use userRecordAccess object to check CRUD permissions..
So pass the recordId and userId.. to check that user having what type of access on that record..
you can check variables like HasDeleteAccess. If HasDeleteAccess true means user have delete access. If false then user don't have access..
Based on these accessibility perform DML..
List<...
7
Adam Torman's answer to a somewhat related (but not entirely) question notes:
We do intentionally block the setting of parent permissions if it's a standard object
By granting any access to a custom object that is M/D to a standard object, that necessitates giving access to that standard object as well.
Managed package permission sets can't grant any ...
6
Force.com IDE
Sometimes, you can still login with the Force.com IDE. It doesn't hurt to try. If you can, you can then download the admin profile, update the settings, and you'll be good to go. Make sure you're logging in from inside the corporate network or another location listed on your Network Access list.
Premier Support
If you have Premier Support, ...
6
Profiles are replicated into a special type of PermissionSet. IsOwnedByProfile will be true, ProfileId will be set to the Profile's Id field. So, you can query PermissionSet to determine a profile's object, field, apex class, and Visualforce permissions via the associated security objects (e.g. ObjectPermissions). Also, see the User Access Visualization open ...
6
The Rule of thumb is permission set extend the access of profile and do not restrict.
1.In first scenario since profile already has access which means permission set cannot disable as permission sets are meant to extend the behaviour
2.Second case its obvious .
If you want to restrict the behaviour for a user ,then disable at profile and do not assign ...
6
You need to give access to visualforce page only. As per the docs:
Once users can access a page, they can execute all Apex that’s associated with the page. This includes:
The controller for the page and any Apex classes called from the controller class.
Any extension classes for the page and any Apex called from an extension.
Any Apex classes ...
6
By fully retrieving all permissions all the time, it will avoid the various Bad Things that happen when you only retrieve a partial package. This would lead to the XML file spuriously growing very large/small simply based on how the tool you're using decided to retrieve your org's metadata (e.g. a partial retrieve would result in a partial permission set, ...
6
Permission sets are not used to prevent access to fields, to do that go to the profiles for the relevant users and untick access on there.
Then use the Permission Sets to give access to the other fields to the users that need to see them.
Permission Sets - Salesforce Help
6
As stated in the SOAP API Documentation
FieldPermissions : Represents the enabled field permissions for
the parent PermissionSet. This object is available in API version 24.0
and later.
So when querying the FieldPermissions object you'll only get the enabled permissions
Possible solution
1- You should query the list of all fields of an SObject with ...
5
I encountered same issue. And the solution which worked for me was that while creating the permission set I was not selecting any User License in the picklist. I created a new permission set with User License as 'Salesforce' and then option for Tab settings in opportunity object became enabled.
May be this could help.
5
Should I replace Feature toggles in Custom Settings with Custom Permissions ?
It depends on the setting. If a user can toggle the feature, it's a preference (custom setting). If it relates to a feature permission, it's probably a custom permission.
Should I have a permission set per User Story or Functional block?
One per feature. For example, a credit ...
5
This relates to the "Send through External Email Services" setting in Setup. Go to Setup > Email Administration > Send through External Email Services to see the setting. According to the description of that setting,
"Allow users to send emails through Gmail/Office 365 when composing emails in Lightning Experience. The Send Email through External Email ...
5
Permission Set Assignments are data in the org. The DML operation cannot be performed by a Change Set - but this sample code might help you in automating the assignments.
// the user reference
User u = new User();
// the names of the permission sets you need to assign
List<String> permissionSets = new List<String>{'permission_set_name_1','...
5
If you don't have Edit access at Object level then, only providing Edit access at FLS will not enable record for Edit.
So, provide Edit access at Object at profile/permission set and then only provide FLS to those fields. Also, remove edit access from the rest of other fields.
5
I had this same issue. I even logged a case with Salesforce about it because it wasn't straightforward.
It occurs when the sysadmin profile has a default record type of Master (for the object) when there is a custom record type.
5
In short: I managed to do this in Apex by using apex-mdapi AFTER I updated the code to support flowAccesses. - here's the github commit with changes needed to support it. This is the only way I can see to do this through Apex as you need to hit the Metadata API.
Very Long Version
I didn't see anything within SOQL or Tooling API that can be used. It seems ...
4
Try using the manual share for the specific opportunity as explained at http://help.salesforce.com/apex/HTViewHelpDoc?id=granting_access_to_records.htm rather than giving him access to opportunities as a whole.
4
I expect this is by design. Since the administrator of the organization has no control over what you're pushing, I would expect the administrators to have to go through a "post-upgrade" step to determine which feature(s), if any, should be enabled. When the administrator chooses to install an upgrade, they are given three choices: "admin only", "everyone", ...
4
While what you stated about visualforce pages may hold true, you can still call classes using things such as AJAX from other locations such as links, buttons, etc. So lets say you have a custom button on a page layout, this button, if it calls a class, the user's profile will need access to that class otherwise it will thrown you an insufficient error
4
There is an easy way to determine if field is a real field or a part of compound field.
There are two tables in Salesforce which correspond to compound fields and its components.
If a field can be found in FieldDefinition table, it is a real (permissionable) field. If a field cannot be found in FieldDefinition table, but can be found in EntityParticle ...
Only top voted, non community-wiki answers of a minimum length are eligible
