45
Turns out it's very easy:
PermissionSetAssignment psa = new PermissionSetAssignment
(PermissionSetId = myPermissionSetId, AssigneeId = myAssigneeId);
insert psa;
31
You can easily check all of your profiles by clicking on "Your Name" > Developer Console > Query Editor, and using the following query:
SELECT Profile.Name, PermissionSet.Label FROM PermissionSet WHERE PermissionsModifyAllData = true
If you see any unexpected profiles there, you can try copying the profiles back from a Sandbox, if you have one available. ...
28
This question is marked as unanswered, despite it was answered in the comments.
Let's revise the answer here:
PermissionSet ps = [SELECT Id FROM PermissionSet WHERE Name = '<required permission set name'];
insert new PermissionSetAssignment(AssigneeId = opUser.id, PermissionSetId = ps.Id);
16
As far as i know anything you can do w permission sets you can do w profiles, but there are a few things that can as of now only be done w profiles.
The key UI difference in my experience is that only profiles can be used to control page layout assignment.
I took a look and at a top level, it looks like the following items are profile only. There may be ...
16
From Salesforce Trust @ 5/17 12:56 pm:
The Salesforce Technology team is investigating an issue impacting Salesforce customers who use Pardot, or have used Pardot in the past. The deployment of a database script resulted in granting users broader data access than intended. To protect our customers, we have blocked access to all instances that contain ...
15
What permission sets allow you to do is minimize the number of profiles that you have to create. It also allows you to temporarily add and remove permissions for users without needing to change their entire profile. In that sense it's a huge time saver. They help keep your org's profiles simpler and your org "cleaner". There always tend to be "exceptions to ...
13
that's a lot of questions!
1) No, you don't need to enable test class access permissions for users
2) Controllers and their extensions do need to be assigned by permissions (https://help.salesforce.com/HTViewHelpDoc?id=users_profiles_apex_access.htm&language=en_US&release=180.7)
3) No, all classes required by a class to which a user has permission ...
11
You can use userRecordAccess object to check CRUD permissions..
So pass the recordId and userId.. to check that user having what type of access on that record..
you can check variables like HasDeleteAccess. If HasDeleteAccess true means user have delete access. If false then user don't have access..
Based on these accessibility perform DML..
List<...
10
We get this error when we are trying to perform DML on setup and non-setup objects in the same transaction.
Try to use System.runAs() in your test class code
Try to use this code:
System.runAs(new User(Id = Userinfo.getUserId())) {
PermissionSet ps = [SELECT Id FROM PermissionSet WHERE Name = 'Provenance_Description_Ownership'];
...
9
Adam Torman's answer to a somewhat related (but not entirely) question notes:
We do intentionally block the setting of parent permissions if it's a standard object
By granting any access to a custom object that is M/D to a standard object, that necessitates giving access to that standard object as well.
Managed package permission sets can't grant any ...
9
In short: I managed to do this in Apex by using apex-mdapi AFTER I updated the code to support flowAccesses. - here's the github commit with changes needed to support it. This is the only way I can see to do this through Apex as you need to hit the Metadata API.
Very Long Version
I didn't see anything within SOQL or Tooling API that can be used. It seems ...
8
How PermissionSet relates to User is illustrated in this User, Sharing, and Permission Objects ERD.
So for example, this SOQL will list all permission set assignments:
select Assignee.Name, PermissionSet.Name
from PermissionSetAssignment
order by Assignee.Name, PermissionSet.Name
and this will list permission sets for a specific user:
select ...
8
Profiles are replicated into a special type of PermissionSet. IsOwnedByProfile will be true, ProfileId will be set to the Profile's Id field. So, you can query PermissionSet to determine a profile's object, field, apex class, and Visualforce permissions via the associated security objects (e.g. ObjectPermissions). Also, see the User Access Visualization open ...
8
As of 3 PM CDT.
This is something I got to hear around from my colleagues who were part of the webinar that Salesforce had around this issue.
The issue seemed to have affected DR sites as well, so rollback seems difficult
Access to other Orgs were restricted as a precaution for the initial issue which impacted Sandboxes too (even if they never had Pardot ...
7
I encountered same issue. And the solution which worked for me was that while creating the permission set I was not selecting any User License in the picklist. I created a new permission set with User License as 'Salesforce' and then option for Tab settings in opportunity object became enabled.
May be this could help.
7
There is an easy way to determine if field is a real field or a part of compound field.
There are two tables in Salesforce which correspond to compound fields and its components.
If a field can be found in FieldDefinition table, it is a real (permissionable) field. If a field cannot be found in FieldDefinition table, but can be found in EntityParticle ...
7
The Rule of thumb is permission set extend the access of profile and do not restrict.
1.In first scenario since profile already has access which means permission set cannot disable as permission sets are meant to extend the behaviour
2.Second case its obvious .
If you want to restrict the behaviour for a user ,then disable at profile and do not assign ...
answered Jul 13 '16 at 3:28
Mohith Shrivastava
83.9k17 gold badges134 silver badges186 bronze badges
7
By fully retrieving all permissions all the time, it will avoid the various Bad Things that happen when you only retrieve a partial package. This would lead to the XML file spuriously growing very large/small simply based on how the tool you're using decided to retrieve your org's metadata (e.g. a partial retrieve would result in a partial permission set, ...
7
As outlined in the documentation, you may only package the following permission set items:
Custom object permissions
External object permissions
Custom field permissions
Custom permissions
Custom tab visibility settings
Apex class access
Visualforce page access
External data source access
All other types, including system permissions, ...
6
In addition to @patiatus answer....
Should you need to setup a custom permission without needing to care about what permission set it belongs to ....
// Given user
User userWithCustomPermission = new User (
... // setup fields for mocked User
};
System.runAs(new User(Id = UserInfo.getUserId())) {
insert userWithCustomPermission;
// Given user w/...
6
Force.com IDE
Sometimes, you can still login with the Force.com IDE. It doesn't hurt to try. If you can, you can then download the admin profile, update the settings, and you'll be good to go. Make sure you're logging in from inside the corporate network or another location listed on your Network Access list.
Premier Support
If you have Premier Support, ...
6
You need to give access to visualforce page only. As per the docs:
Once users can access a page, they can execute all Apex that’s associated with the page. This includes:
The controller for the page and any Apex classes called from the controller class.
Any extension classes for the page and any Apex called from an extension.
Any Apex classes associated ...
6
This relates to the "Send through External Email Services" setting in Setup. Go to Setup > Email Administration > Send through External Email Services to see the setting. According to the description of that setting,
"Allow users to send emails through Gmail/Office 365 when composing emails in Lightning Experience. The Send Email through External Email ...
6
Set Email Deliverability to 'All Email':
For unknown reason Salesforce automatically creates and removes this permission completely behind the scenes on all profiles based on the value of this setting. This will fail deployments that contain profiles from orgs where this setting is set to 'All Emails' where the target org has this setting set to 'No Access' ...
6
I spend some time digging deep into why I could not assign a Permission Set to multiple users within my DE org (Developer Edition) to come to the realization that these users were inactive within the environment.
I just want to post this as an answered question incase anybody else has this issue.
6
You can check this link
http://hellosnl.blogspot.com/2017/08/salesforce-security-concepts.html
Also check this image
6
Permission sets are not used to prevent access to fields, to do that go to the profiles for the relevant users and untick access on there.
Then use the Permission Sets to give access to the other fields to the users that need to see them.
Permission Sets - Salesforce Help
6
Why would a user not see Global or Quick Actions?
Despite the User being assigned a Page layout with Global or Quick
Actions selected to display, they cannot see them in the Feed. This
can occur when the Global or Quick Actions are creating a Record with
a Recordtype to which the User does not have access.
This is expected as Buttons, links, and ...
6
I had this same issue. I even logged a case with Salesforce about it because it wasn't straightforward.
It occurs when the sysadmin profile has a default record type of Master (for the object) when there is a custom record type.
6
As stated in the SOAP API Documentation
FieldPermissions : Represents the enabled field permissions for
the parent PermissionSet. This object is available in API version 24.0
and later.
So when querying the FieldPermissions object you'll only get the enabled permissions
Possible solution
1- You should query the list of all fields of an SObject with ...
Only top voted, non community-wiki answers of a minimum length are eligible