Activate Session-Based Permission Sets Without Code
Follow Along with Trail Together
Want to follow along with an expert as you work through this step? Take a look at this video, part of the Trail Together series.
(This clip starts at the 11:24 minute mark, in case you want to rewind and watch the beginning of the step again.)
Activation Options for Session-Based Permission Sets
Now that you’ve created a session-based permission set of your own, let’s make it usable. To make it usable, you need to have a way to activate a session for the permission set. If you like getting your hands dirty with APIs, you can do that, and we won’t stop you. The PermissionSet object in the Soap API contains a field called HasActivationRequired, a boolean that indicates whether the permission set requires an associated active session (true) or not (false). Insert a record into the SessionPermSetActivation object with the combination of session ID and permission set to achieve the activation.
Don’t know how to code? That’s OK. Salesforce has a nice declarative tool that you might already use: Flow. We’ll use a flow to help make your session-activation process smooth, even if you don’t code.
Before you jump in, it helps if you’re familiar with using Flow. If you’re not familiar with flows, no problem. We create a simple one here. In fact, this flow functions with only one step! However, you probably already guessed that Trailhead has you covered if you want to learn more—and we encourage you to do so. Check out the Build Flows with Flow Builder trail. Make sure that you have permissions to access flow to continue, though! Let’s check permissions right now.
- Go to your profile. In Setup, go to Users and select your profile. You’re more than likely using the System Administrator profile.
- Look for Manage Flow and make sure it’s selected.
Now back to our flow for session-based permission sets.
- From Setup, enter Flows in the Quick Find box, then select Flows, and click New Flow.
- Select Screen Flow and click Create.
- Change Auto-Layout to Freeform in the dropdown list.
- From the Elements tab in the toolbox, drag Action onto the canvas.
- In Search All actions..., begin typing Activate and select Activate Session-Based Permission Set.
- For Label, use Activate Employment Contracts Access. The API Name defaults to Activate_Employment_Contracts_Access.
- On Set Input Values in Permission Set Name, type Employment_Contracts_Access. (This value is the API name of your permission set!
- Click Done.
- Drag the connector node at the bottom of Start onto your Action.
- Save your flow with the name Activate Contracts Access as a Screen Flow.
Here’s what the flow looks like.
The flow creation steps were easy, right? So easy, in fact, that if you’re an experienced user of flows, you’re probably thinking, “Can’t we do more than a one-step flow?” We can. Right now, though, we’re focused on using session-based permission sets, so let’s proceed. Run the flow from Flow Builder by clicking Run. Running the flow activates the permission set. But after you click Run, you see an error screen. Oops. Now, check your email.
What? “Check your email”?
Yup. The reason why is that you’ll also receive a message explaining the error you saw in Salesforce. It seems that no one is assigned yet to the Employment Contracts Access permission set. If you run across problems when working with your flow, check if you received any emails about errors. Remember that we’re working with three different areas: permission sets, user assignments, and flows. The detail in the emails can help you troubleshoot quickly. For example, you receive an error if you reference a non-existent permission set name in your flow, if your flow contains logical issues, or if you haven’t assigned the permission set referenced in the flow to a user. In this case, you get an email that includes detail about the lack of user assignment.
Error Occurred: The permission set must be pre-assigned to the user before being activated
Remember that we said you could ignore the warning you got earlier, because we're still building this flow? You can ignore this error too. We assign the permission set to a user, but that user doesn't exist yet in our org. We create the user next. Typically you probably assign users to your permission set first. However, let’s say you forgot to assign a new employee to the permission set. What would happen if this person attempted to run the flow? You guessed it.
It’s good to be aware of some of the errors you or users can run across that have easy solutions. Now activate your flow: return to Flow Builder, and click Activate. Activating your flow without a user assigned to the permission set causes no harm. However, our flow can't accomplish what we need until someone is assigned to the permission set.
- Assign the user to a profile, making sure that the person has read-only (no edit) access to the Contracts object. The person must run flows. For example, you could assign the user a clone of the Minimum Access - Salesforce profile, grant read access to the Contracts object, and enable the Run Flows permission.
- Assign the Employment Contracts Access permission set to the user.
Stay logged in as the user, go to Flows in Setup, and run the Activate Contracts Access flow. If you go to the Contracts object, notice that there’s now a New button available to create a contract.