How to limit Customer Portal users' access to cases based on custom fields?

[brianwenzl]

Hello,

Long time listener, first time caller.  

I have a need to set up Accounts with a detail object called Sites, and to restrict access to Cases in Customer Portal based on Site.  

For example, I might have an Account called "Customer Company" with Sites called "2nd Floor installation," "4th floor installation," and "production installation - main floor."  

I want to be able to manage this (if possible!) as one Account, but restrict portal users so that, say, Susie can see Cases related to 4th floor only, Bill can see Cases for main floor and 2nd floor, and Janice can see all Cases for the Account.

I realize I could create an Account for each Site and use Parent Account field to link everything up, but because it's one building with one purchaser, I'd prefer to be able to manage it under one Account for simplicity of Sales.  

Anyone got any tricks up their sleeve?

Thanks

Brian

[werewolf]

I vote for the parent account scheme.

You could rig up some Apex that uses this custom field to create manual share row entries in the CaseShare table to manage this.  Said Apex would not be that hard to write, but it could on occasion conflict with your sharing rules so it could be tricky to manage long-term.

May I suggest that you add a custom "Parent Account" field to Case, and a little Apex trigger that populates it with the top-level parent account?  Then you get the best of both worlds -- you'd get the built-in sharing segmentation of the multiple accounts, but also you'd have visibility from the parent account to the child accounts' cases via a simple and standard related list.  This assumes that your account hierarchy would be only one level deep though.

[brianwenzl]

Thanks werewolf. 

Customer care team is pretty sensitive to creating new Accounts, which, in general I applaud (though in this case there's a compelling reason to do it), so I think we're going to do some traffic-directing based on the Site field and not worry too much about the access - after all, they're only support cases.

Parent Account remains the best way to go, but is in our situation not, shall I say, politically acceptable?

Anyway, appreciate the help.

Brian