function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
Drew1815Drew1815 

Sites and inserting/updating Accounts

I know the anonymous profile created along with a Force.com Site does not allow a Site to create or edit standard objects such as Accounts. As part of my prototype, I created a custom object that the Site inserts and updates records. Then, I created an Apex Trigger to move that data from the custom object to the standard Account object (using Upsert and an External Id). I had expected the Apex Trigger to fail in the context of a Site since the Site Profile doesn't allow Create on Accounts. But I was able to upsert the Account objects when the Site inserts or updates to a custom object. This solution works for me - but I did want to verify this is expected functionality. 

 

Thanks. 

Best Answer chosen by Admin (Salesforce Developers) 
BulentBulent

Force.com sites allows you to create and read on standard objects except (ideas, products and price books; only read access for these three objects)

 

You can create and read account records but update is not allowed via the site license. With your workaround you are violating the site license use case.

 

You need to be authenticated user in order to get more access to these standard objects. PRM portal license allows authenticate users to update accounts. 

All Answers

BulentBulent

Force.com sites allows you to create and read on standard objects except (ideas, products and price books; only read access for these three objects)

 

You can create and read account records but update is not allowed via the site license. With your workaround you are violating the site license use case.

 

You need to be authenticated user in order to get more access to these standard objects. PRM portal license allows authenticate users to update accounts. 

This was selected as the best answer
BreakevenBreakeven

This almost eliminates Sites as a solution for any B2C portals because requiring partner/customer licenses makes it cost-prohibitive...probably many B2B portals as well.

 

Is there any update on this issue?  

BulentBulent

you can create accounts and contacts during registration, and you'll have read access within portal and full crud on custom object.

what part is eliminating b2c use cases? 

BreakevenBreakeven

It prevents you from adding them to campaigns, using email workflow or adding them to 3rd party email services like Vertical Response.  My clients want a 360 view of their contacts and to leverage the powerful Contact Management functionality that SF provides.  By not allowing the guest to update their contact info, you are restricting the value to the client and it is being perceived as a money grab. 

 

A suggestion would be to allow CRUD to the Contacts object while restricting all other standard objects.  This will still deter people from building license-free Salesforce-like functionality, but enables full contact management of guest users.

BulentBulent

Rather than full CRUD on accounts and contacts, portal users updating their own account and contacts (profile) would solve the issue?

 

Guest user updating contact is problematic, which means guest can update any contact. Once you authenticate you know who the user is. 

BreakevenBreakeven
Here is the requirement.... we build a B2C portal and use our own custom authentication, the user would still be a guest user in sites.  We restrict access to only their contact info and store their login credentials in their SF contact record.  After authenticating, the user would be able to update their own contact info, but have no access to anyone else, nor have crud access to any other standard objects.  How can i do this without requiring partner/customer portal licenses?
BulentBulent

We do not advice/support custom authentications. If you have attended to any of our webinars we clearly stated that. 

 

There are many security features that is built in the portal product such as password management, reset password, change password, authentication, session management, roles etc. You will only get these salesforce approved features if you go with the recommended sites-portal integration.

 

There is no plan to extend the standard object access beyond what it is today for unauthenticated use case. 

 

If you are a partner you might be violating your partner agreement, please talk to salesforce partner team. 

Message Edited by Bulent on 08-28-2009 12:22 PM