Implementing the Security Model
In the preceding section, you designed the sharing model for the Services Manager sample application. In this section, you will implement it in your Force.com DE organization. The implementation involves five separate tasks:
1. Create profiles—Profiles control access to objects and fields. The profiles in Services Manager are modeled after job functions such as Consultant and Project Manager.
2. Configure field accessibility—Profiles also provide fine-grained control over the fields within an object. In Services Manager, several cases exist in which a particular type of user needs Read access to an object, but not the whole object. Some fields are sensitive and should be hidden. Supporting these cases using field-level accessibility settings is easy.
3. Set organization-wide defaults—This is the first step in defining record-level control over data. All records have an owner, initially the user who created the record. Organization-wide defaults are defined on each object and dictate which users besides the owner, if any, also receive access to the records.
4. Establish role hierarchy—Roles provide a way to group users into a hierarchy. Users at higher levels in the hierarchy receive access to all records owned by their subordinates. In the Services Manager example, roles are used to model geographically distinct business units. By default, business units do not share data with each other. An executive team at the top of the hierarchy receives access to all data.
5. Add sharing rules—Sharing rules are one way to override the organization-wide defaults. They automatically share records between two groups of users based on record ownership and group membership. In Services Manager, sharing rules are used to allow record owners in the same business unit to collaborate on the same data. For example, if two Project Managers are in the West, they should be able to see each other’s Project records because they work on the same team.
Create Profiles
On the Setup screen in the Administration Setup area, click Manage Users, Profiles. For each profile identified in Table 3.1, follow these steps:
1. Click the New Profile button.
2. Select an existing profile to use as the starting point for the new custom profile. Standard Platform User is a good choice because the Services Manager sample application can work with a Salesforce Platform user license.
3. Enter the profile name and click the Save button.
4. The new profile is created—a copy of the existing one. Click the Edit button to customize it.
5. In Custom App Settings, select Services Manager as the default.
6. Scroll down to the Standard Object Permissions section. Check off the boxes as appropriate to grant access to Accounts and Contacts. Repeat the same process in the Custom Object Permissions section for the four custom objects in the Services Manager application.
7. Click the Save button. As a shortcut to create more profiles, click the Clone button and start building the next profile from step 3.
When you’re done, your Profiles page should resemble Figure 3.11.
Configure Field Accessibility
In addition to object-level security, you also need to protect sensitive fields. Newly created custom fields are always invisible. They must be explicitly made visible using a profile or permission set. You need to consider the sensitivity of each field to each type of user, an excellent security best practice enforced by Force.com. For example, a Consultant can see all of the fields on a Project object except the finance-related fields Consulting Budget, Expense Budget, and Invoiced.
Follow this procedure to set the visibility of fields in an object:
1. Click Setup, and in the Administration Setup area, click Security Controls, Field Accessibility.
2. Click the object to configure—for example, Project.
3. Click View by Profiles.
4. Select the profile—for example, Consultant. At a glance, you can see the access level of every field in the profile.
5. For each field to change, click its corresponding field access value.
6. Click the first Visible check box to make the field visible to this profile.
7. Click the Save button.
8. Repeat from step 4 until every profile is assigned the correct access levels for this object.
Make all fields on the object visible for the remaining profiles. When you’re done with these steps for the Project object, your Field Accessibility screen for the Consultant profile should resemble that shown in Figure 3.12.
Repeat this process on the following objects:
Timecard—All fields visible, but invoice-related fields (Invoiced, Invoice Number, Invoice Date) are hidden from the Consultant profile.
Assignment—All fields visible, but finance-related fields (Hourly Cost, Hourly Rate, Planned Cost, Planned Margin, Planned Revenue) are hidden from the Consultant profile.
Contact—All fields visible, but the Hourly Cost Rate field is hidden from the Consultant profile.
1. Click Setup. In the Administration Setup area, click Security Controls, Sharing Settings.
2. Click the Edit button.
3. In the Project row, select Private. Repeat this for Contact.
4. Click the Save button.
All Projects and Contacts are now private. This means that only the owner of a Project or Contact is able to see it. Although this is not the desired behavior, it is the most restrictive setting. From there, you will use sharing rules to open access to members of the same business unit.
Establish Role Hierarchy
In the Services Manager sample application, business units are represented using roles. Roles are chosen over public groups because they provide the one-way sharing needed between business units and the executive team.
To configure the roles, follow these steps:
1. Click Setup. In the Administration Setup area, click Manage Users, Roles. If you’ve never used this feature before, click the Set Up Roles button to continue past the display of sample role hierarchies.
2. Rename CEO to Executive.
3. Rename three of the roles reporting to Executive to West, Central, and East.
4. Delete the unneeded roles, starting with those at the lowest level of the hierarchy.
When you’re done, your role hierarchy should appear as shown in Figure 3.13.
Add Sharing Rules
The goal in using sharing rules is to allow users in the same business unit to collaborate and share data. A record created by one user should be available to all users in the same business unit and their superiors, the executive team.
To configure sharing rules, follow these steps:
1. Click Setup. In the Administration Setup area, click Security Controls, Sharing Settings.
2. Scroll to the bottom of the screen. Click the New button in the Project Sharing Rules section.
3. Enter a rule label, and its name will be automatically set based on the label—for example, West.
4. The first pair of drop-down lists identifies the record owners who will be sharing. Select Roles from the first drop-down list and a role from the second—for example, West.
5. Select the group of users to share with. To share records within the same business unit, set this pair of drop-downs to the same values as those in the preceding step—for example, Roles and West.
6. The final drop-down list, Access Level, specifies the level of access that the second group of users receives to the shared records. Select Read/Write.
Repeat this process to share Project records within the other two business units, Central and East. Records are automatically shared with executives because they lie above the business units on the role hierarchy. Figure 3.14 shows the completed list of sharing rules.
