Access Management
GRAX controls access levels via Permission Set assignments. At the bottom of this document, those permission sets are explained and broken down, but let's first cover what the resultant access would look like for users. Below is a summary of each high-level GRAX feature, and how access levels interact with them.
Feature | Standard User | Seeding User | Power User | Admin User |
---|---|---|---|---|
Auto Backup Dashboard | None | None | View | View and Configure |
Archive | None | None | View and Run | View and Run |
Restore | None | None | View and Run | View and Run |
Delete Tracking | None | None | View | View |
Sandbox Seeding | None | View and Run | View and Run | View and Run |
Search | View and Run | View and Run | View and Run | View and Run |
History Stream | None | None | View | View and Configure |
Settings | None | None | None | View and Configure |
To summarize the main differences between these 4 access levels:
- Admin User can see and do everything
- Power User has nearly the same access as Admin User, but cannot see
Settings
and cannot configure objects for Search or History Stream - Seeding User can run Global Search and Seed records into a Sandbox
- Standard User can lookup records by the ID and see record details, but cannot see any other features
You can find a call-out in the GRAX navigation menu stating the current logged in user's access level. Note that the Permission Sets are cumulative, such that the user has the highest level of access granted.
Controlling Access
Any user that wants to access GRAX must first have the proper Salesforce permission set assignments. There are 2 supported ways to assign Salesforce permission sets.
GRAX Console Permissions
GRAX Auto Config
creates the following user access permission sets in Salesforce when you connect the GRAX Application to your Salesforce org the first time.
GRAX Console Standard Permission
: Standard User access per the table aboveGRAX Console Seeding Permission
: Seeding User access per the table aboveGRAX Console Power Permission
: Power User access per the table aboveGRAX Console Admin Permission
: Admin User access per the table aboveGRAX Console View All Fields
: Do not apply Field Level Security checks to this user in the GRAX Application (see below for more details)
The GRAX Console Admin Permission
permission set is assigned to the GRAX Integration user account automatically otherwise these are created but not assigned. Please be sure to assign the proper level of access to all users that you want to access the GRAX Application.
Manually Creating the Console Permissions
The following script can be used to create the 4 GRAX Permission Sets using the Salesforce Developer Console:
- Open the Salesforce Developer Console
- Open the
Debug
menu - Select
Open Execute Anonymous Window
(or pressCTRL + E
) - Copy the script below into the
Enter Apex Code
dialog - Select the
Open Log
checkbox - Click
Execute
PermissionSet pa = new PermissionSet(Name = 'GRAX_Console_Admin_User', Label = 'GRAX Console Admin Permission', Description='Grants users Admin User permissions to the GRAX console');
insert pa;
PermissionSet pp = new PermissionSet(Name = 'GRAX_Console_Power_User', Label = 'GRAX Console Power Permission', Description='Grants users Power User permissions to the GRAX console');
insert pp;
PermissionSet ps = new PermissionSet(Name = 'GRAX_Console_Seeding_User', Label = 'GRAX Console Seeding Permission', Description='Grants users Sandbox Seeding permissions to the GRAX console');
insert ps;
PermissionSet pu = new PermissionSet(Name = 'GRAX_Console_Standard_User', Label = 'GRAX Console Standard Permission', Description='Grants users Standard User permissions to the GRAX console');
insert pu;
Field Level Permissions
In addition to the Access Levels above, GRAX applies field level permissions to all users logged in via SSO. This means you can restrict what fields they see in the GRAX Application the same way you'd do for any Salesforce user. The "View All Fields" modifier allows a user to see add fields on an object in GRAX, regardless of their Salesforce Field Level Security or the current object schema.
The following script can be used to create this GRAX Permission Set using the Salesforce Developer Console:
- Open the Salesforce Developer Console
- Open the
Debug
menu - Select
Open Execute Anonymous Window
(or pressCTRL + E
) - Copy the script below into the
Enter Apex Code
dialog
PermissionSet pv = new PermissionSet(Name = 'GRAX_View_All_Fields', Label = 'GRAX Console View All Fields', Description='Grants users access to view all fields in GRAX regardless of their Field Level Security permissions');
insert pv;
Use Permission Sets Installed Via the GRAX for Salesforce package
These permission sets are installed when you install the GRAX Managed Package for Salesforce. They control user access within the managed package, as well as within the GRAX webapp and embedded experiences.
Managed Package Salesforce Permission Set | Standard User Access | Power User Access | Admin Access |
---|---|---|---|
GRAX_Configuration_Admin | ![]() | ![]() | ![]() |
GRAX_Advanced_User | ![]() | ![]() | |
GRAX_User | ![]() |
Next Steps
To proceed with connecting GRAX to Salesforce and your storage platform of choice, start with our connection documentation.
Updated about 4 hours ago