[SalesForce] APEX Sharing stopped working in community

We had a small widget that allowed customers to share records that were set to a private sharing model in our community. Everything was rather simple and it would simply allow them to select users that were visible via Sharing Sets and create an __Share record in APEX.

I've been reported recently that an error is thrown but only on the community side of things. Nothing seems to be working where it was working. We are using Customer Community Plus licenses.

The error being thrown is : System.TypeException: DML operation INSERT not allowed on <Object>__Share which seemed to indicate access not available on the object. That seems odd because they are able to interact with the object just fine in order to create/edit/delete them.

I looked up the Sharing Model (its private both internally and externally), I looked at the profile and their access and the sharing sets in the community. Like I said, they seem to interact fine with the objects when it comes to seeing the records and their right.

Additionally, standard license users can use the component fine and also share with community users without a problem. They also see the records as expected.

Am I missing an update or something that seem to make it so this doesn't work anymore? Anyone having trouble with this or encountered the same problem?

Best Answer

If you refer to Sharing a Record Using Apex documentation, and within that refer to the section (all the way at the bottom of the page) Creating Apex Managed Sharing for Customer Community Plus users, you will find that Share objects are not available for Customer Community Plus Licenses. The complete text from the documentation is as below (emphasis mine).

You will need to address this situation by taking the approach as mentioned in the documentation (by using without sharing).

Creating Apex Managed Sharing for Customer Community Plus users

Customer Community Plus users are previously known as Customer Portal users. Share objects, such as AccountShare and ContactShare, aren’t available to these users. If you must use share objects as a Customer Community Plus user, consider using a trigger, which operates with the without sharing keyword by default. Otherwise, use an inner class with the same keyword to enable the DML operation to run successfully. A separate utility class can also be used to enable this access.

Granting visibility via manual/apex shares written to the share objects is supported but the objects themselves aren't available to Customer Community Plus users. However, other users can add shares that grant access to Customer Community Plus users.

Related Solutions

[SalesForce] Is is possible to grant delete permissions using apex managed sharing

See this answer I had asked another question on this topic because the answer by Ralph Callaway didn't work for me (but I really wanted it to)

I am copying the answer from the original question I asked because I don't want it to be a link only answer. I'm putting it here so others are not misled to think giving Delete access on the object and an edit apex managed share wil let the user delete the record.

The credit for the answer goes to ca_peterson and is reposted here:

The statement from the docs http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_bulk_sharing_understanding.htm

is key here:

This access level can only be granted with Force.com managed sharing.

in reference to the "full control" sharing setting.

Force.com managed sharing is the term for sharing that is granted by the platform itself - so record owner and manager of record owner if you simplify the statement.

Per the docs linked there you need "Full Access" to be allowed to delete.

Pair these two facts together and it turns out that nope - there's no way to grant delete access via apex sharing rules. The only options are to use force.com managed sharing (i.e. change the owner, or be above the owner in the role hierarchy), or grant modify all on the profile/perm set.

The other option would be to make a custom VF page or action that allows deleting the record via without sharing apex if the user has edit rights, but that doesn't allow the normal delete DML event, so has some drawbacks.

[SalesForce] Community: Sharing Sets and Sharing Records – High volume

Sharing Sets benefits are that they permit sharing of records to High Volume Community licences that cannot use Sharing Rules or Apex Sharing.

Sharing Sets cannot be used as an alternative to Sharing Rules as they are not available to licence types that can use the rules such as Customer Community Plus or Partner Community users.

An advantage of Sharing Sets over Sharing Rules can be that they are easier to define as it is possible to setup a sharing set with criteria like

'User:Account' = 'Case:Account'

While for Sharing Rules it is necessary to create a separate sharing rule for each Customer or Partner Organisation (which will have its own Role) to share records owned by users with that Role with the other users with that Role, and say with cases if the ownership changes to an internal user or queue then access to the case could be lost, unlike the Sharing Set. This can of course be worked round by using Groups, but that adds a layer of maintenance to the SF Organisation setup.

Sharing sets do not seem to create a record in the sharing tables for the database as I have tried retrieving them using Data Loader and cannot find an entry that corresponds to the profile or other information related to the high volume licence types.

Best Answer

Related Solutions

[SalesForce] Is is possible to grant delete permissions using apex managed sharing

[SalesForce] Community: Sharing Sets and Sharing Records – High volume

Related Topic