043_关于Salesforce集中权限的解释

1.创建Object的时候，一定要选中Deploy，避免在All Tabs 中找不到

2.在Profile里，选择 Standart tab Setting、Custom tab setting，有三个值 tab off 、on 、hidden

3.setting->App, 选中这个app需要由哪些object构成的，在选择需要访问这个app的profile

集中访问级别：

1、OLS：Obejct Level Security  在Profile 中Standard/Custom Object Permission   Access Level :create delete update edit/Modified all ,view all

2、FLS:Filed Level Security  在Profile 中Standard/CustomField-Level Security 设置字段的访问权限

3、在object 中的指定filed中Field-Level Security for Profile 有两个按钮Set Field-Level Security(A)\View Field Accessibility(B) ，假如在A中针对一个profile设置了visible和read only，那么在B中显示的就是Read only；假如在A设置了read only，那么b显示的就是Hidden，　　不好理解吧，那就从这两个按钮来理解，一个是Set的，一个是Set之后可以view的结果，慢慢体会

4、Pagelayout 中添加submit for approval,前提是在approve中有这个approve

5、Record Level Scurity：这部分请参照我之前的文章 http://www.cnblogs.com/bandariFang/p/6229476.html、http://www.cnblogs.com/bandariFang/p/5465612.html

Managing the Sharing Settings

Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions

Teams are not available in Database.com

User Permissions Needed
To set default sharing access:	“Manage Users” AND “Customize Application”

Using Salesforce, you can
control access to data at many different levels. For example, you can
control the access your users have to objects with user profiles.
Within objects, you can control the access users have to fields using
field-level security. To control access to data at the record level,
use the sharing settings described below.

To view your sharing settings, click Your Name | Setup | Security Controls | Sharing Settings. You can either view all lists at once, or you can use the Manage sharing settings for drop-down list at the top of the page to view only organization-wide defaults and sharing rules for a selected object.

Organization-Wide Defaults

Your organization-wide default sharing settings
give you a baseline level of access for each object and enable you to
extend that level of access using hierarchies or sharing rules. For
example, you can set the organization-wide default for leads to Private
if you only want users to view and edit the leads they own. Then, you
can create lead sharing rules to extend access of leads to particular
users or groups.

Sharing Rules

Sharing rules represent the exceptions to your organization-wide default settings. If you have organization-wide sharing defaults of Public Read Only or Private,
you can define rules that give additional users access to records they
do not own. You can create sharing rules based on record owner or
field values in the record.

Tip

Sometimes
it's impossible to define a consistent group of users who need access
to a particular set of records. In those situations, record owners can
use manual sharing to give read and edit permissions to users who would
not have access to the record any other way. Although
manual sharing isn't automated like organization-wide sharing
settings, role hierarchies, or sharing rules, it gives record owners
the flexibility to share particular records with users that need to see
them.

Apex Managed Sharing

Apex managed sharing allows developers to programmatically share custom objects. When you use Apex
managed sharing to share a custom object, only users with the “Modify
All Data” permission can add or change the sharing on the custom
object's record, and the sharing access is maintained across record
owner changes.

For more information on Apex managed sharing, see the Force.com Apex Code Developer's Guide.

Other Methods for Allowing Access to Records

In addition to sharing settings, there are a few other ways to allow multiple users access to given records:

Map category groups to roles

Control access to data categories by mapping them to user roles. See About Category Group Visibility.

Queues

Queues help your teams manage leads, cases, service contracts, and custom objects. Once
records are placed in a queue manually or through an automatic case or
lead assignment rule, records remain there until they're assigned to a
user or taken by one of the queue members. Any queue member or users
above them in the role hierarchy can take ownership of records in a
queue. Use queues to route lead, case, and custom object records to a group.

Teams

For accounts, opportunities, and cases, record owners can use teams to allow other users access to their records. A team
is a group of users that work together on an account, sales
opportunity, or case. Record owners can build a team for each record
that they own. The record owner adds team members and specifies the
level of access each team member has to the record, so that some team
members can have read-only access and others can have read/write
access. The record owner can also specify a role for each team member,
such as “Executive Sponsor.” In account teams, team members also have
access to any contacts, opportunities, and cases associated with an
account. Note

A
team member may have a higher level of access to a record for other
reasons, such as a role or sharing rule. In this case, the team member
has the highest access level granted, regardless of the access level
specified in the team.