Deploying Permission Sets

[Garrettz]

I am new to development, but learning fast.

I currently have a Prod environment, Dev environment, and creating a Full Test enviornment. I have some Permission Sets in Prod (we needed them immediately to release an App) that I would like to deploy to Dev and Test. I also have Profiles and some more Permission Sets in Dev that I would like to eventually deploy to Test and Prod.

I know change sets does not include the Metadata to deploy the Object Level Security/Field Level Security or the Assign Apps, so I was referred to the IDE to deploy these changes.

I went to the IDE and I saw Profiles as a Metadata Component to add, but I'm not seeing Permission Sets.

My first question is - is the IDE the right tool to deploy Profile and/or Permission Set changes to App Assignments, Object Settings, and System Permissions?

My next question is - Why do I only have Profiles as a choice of Metadata Components to deploy through the IDE?

Another question I will have is how do I push changes from one Organization to another, but I can look that up on my own or research it later.

Thanks in advance for any help!

-Garrett

[Rakesh2020]

Ha ha .. Welcome to the Salesforce deployment world !!!

This is the most painful part of salesforce.com deployment , deploying permission sets and Profiles.

- The Profiles and Permission Sets are present in both Change sets and also available in force.com metadata API , so you can even use ANT deployment tool to port the code.

- The catch here is that the Object FLS will be migrated from one org to other only if you include the whole object along with the respective Profile or permission set you want to migrate in the porting package. Only then the FLS will be migrated to the other environment else only the profile system permission will be migrated but not the actual object FLS or record type settings.

Else, you are left with manually updating the FLS.

[Garrettz]

Hmm, that sounds painful. So if I update every FLS on the Lead object, I need to add the entire Lead object and fields with it? Sounds excessive, but the other option of manually updating every FLS just isn't realistic.

Thanks for the welcome and advise - I'll give this a try and see if I can get it to work.

[Rakesh2020 · Accepted solution]

Yes, if you update the FLS on lead , the you can selectively all those fields and permission set or profiles  this works better in case of change sets.

Where as if you are using Force.com ANT deployment tool then its easy to push the whole object.

Thanks,

Rakesh 

[Garrettz]

Hey Rakesh,

Another quick question. I realized that managed apps prevent you from transfering and deploying fields from instance to instance. Because of this, does that mean it is not possible to create a permission set for an installed app and deploy that on dev or test servers?

[Saurabh Dhoble]

Having lived through the same pains, I have found it so much easier to deploy the entire SF code base using ANT. Here's what we did -

1. Using eclipse, download the entire SF code (you can get everything, permission sets, profiles etc.)

2. Check this code(basically XML files) into source control

3. Whenever we make changes to our DEV sandbox, we download the corresponding XML files and check into the code repository.

4. Always deploy to QA/UAT only from the source control repository - no manual changes to these environments.

I'm not sure if this will solve your current problems, but if you want to save yourself a whole lot of pain and frustration, start thinking about deployment now.

[Garrettz]

Thanks Saurabh,

Yea, I'm definitely finding that I should start to learn how to use ANT. The IDE is good for deployment, but it's not looking like I'm passing everything correctly, or I need to modify what I have.