Repository navigation
Retrieving Permission Set with RetainFieldHistory User Permission In Org Doesn't Include Permission #3648
Description
Activity
Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.
Hi @nickytorstensson, thanks for reporting! the cli writes the xml returned by the metadata API as-is, it does not filter or modify userPermissions. This is a platform gap issue rather than a cli. To confirm, could you run both retrieves with
SF_MDAPI_TEMP_DIRset? This saves the raw Metadata API response before any CLI processing:SF_MDAPI_TEMP_DIR=/tmp/mdapi-ps sf project retrieve start -m PermissionSet:sysadmin --target-org <your-org> SF_MDAPI_TEMP_DIR=/tmp/mdapi-profile sf project retrieve start -m Profile:Admin --target-org <your-org>Then compare:
grep -i "RetainFieldHistory" /tmp/mdapi-ps/*_retrieve/metadata/unpackaged/permissionsets/sysadmin.permissionset grep -i "RetainFieldHistory" /tmp/mdapi-profile/*_retrieve/metadata/unpackaged/profiles/Admin.profileHi @soridalac
I am unable to run your script, the very first command. Could you help me here?
Hi @soridalac I hope you're doing well. Have you seen my previous comment?
Hi @nickytorstensson , sorry for the delay! The error you're seeing is because ps is setup differently, try this:
- Create temp directories
mkdir C:\temp\mdapi-ps mkdir C:\temp\mdapi-profile- Retrieve PermissionSet with raw API response saved
$env:SF_MDAPI_TEMP_DIR = "C:\temp\mdapi-ps" sf project retrieve start -m PermissionSet:sysadmin --target-org <your-org>- Retrieve Profile with raw API response saved
$env:SF_MDAPI_TEMP_DIR = "C:\temp\mdapi-profile" sf project retrieve start -m Profile:Admin --target-org <your-org>- Compare — check if RetainFieldHistory appears in the raw Metadata API response
Select-String -Path "C:\temp\mdapi-ps\*\metadata\unpackaged\permissionsets\sysadmin.permissionset" -Pattern "RetainFieldHistory" Select-String -Path "C:\temp\mdapi-profile\*\metadata\unpackaged\profiles\Admin.profile" -Pattern "RetainFieldHistory"Replace with your target org alias. This will help us determine whether the Metadata API itself is omitting
RetainFieldHistoryfrom the PermissionSet response, or if something in the CLI processing is filtering it out.@soridalac I ran all your commands, but the final two rows (4.) does not yield any output.
It looks like when I run (2.) and (3.) then the path still remains in the force-app rather than in the temporary directories you specified.
With this, the results are the same as my initial screenshot. The profile includes the system permission, but the permission set does not.
@nickytorstensson , thanks for trying! Were the temp dir have any files or empty? If the temp dir were empty, which is why step 4 had no output. Try to combine them into one line command:
$env:SF_MDAPI_TEMP_DIR="C:\temp\mdapi-ps"; sf project retrieve start -m "PermissionSet" -o <your-org-alias>
$env:SF_MDAPI_TEMP_DIR="C:\temp\mdapi-profile"; sf project retrieve start -m Profile:Admin --target-org <your-org>Then check if the temp dirs have files:
dir C:\temp\mdapi-ps dir C:\temp\mdapi-profileIf they do, run the same Select-String from step 4.
SF_MDAPI_TEMP_DIR doc: https://developer.salesforce.com/docs/platform/sfdx-setup/guide/sfdx-setup-trouble-temp-mdapi-dir.html
@soridalac , are you sure the command "Select-String" is doing the right thing?
Now I ensured that the folders have content, but the command still doesn't do anythin:
@nickytorstensson , can you open both file in the metadata folder and search for the string
RetainFieldHistory? The folder contains the raw server response before any CLI processing. If it's in the Profile but not the PermissionSet, that confirms the Metadata API itself isn't including it.Hi @soridalac the issue is exactly the same as initially posted:
- The permission set doesn't include the RetainFieldHistory system permission
- But the Admin profile includes it
Reacted by Sorida LacWe have determined that the issue you reported exists in code owned by another team that uses only the official support channels. To ensure that your issue is addressed, open an official Salesforce customer support ticket with a link to this issue. We encourage anyone experiencing this issue to do the same to increase the priority. We will keep this issue open for the community to collaborate on.
Summary
I try to retrieve a permission set from my org.
sf project retrieve start -m PermissionSet:sysadminIn contrast, the user permission is included, when I retrieve the standard System Administrator profile
sf project retrieve start -m Profile:AdminSteps To Reproduce
RetainFieldHistorysf project retrieve start -m PermissionSet:sysadminTip
use
sf doctor --create-issueto automatically fill the required informationExpected result
Expected the permission set to include:
Actual result
It didn't include the user permission, despite being set in the org.
Additional information
System Information
Which shell or terminal are you using? PS
{ "architecture": "win32-x64", "cliVersion": "@salesforce/cli/2.150.6", "nodeVersion": "node-v24.19.0", "osVersion": "Windows_NT 10.0.26200", "rootPath": "C:\\Users\\ext-nto\\AppData\\Local\\sf\\client\\2.150.6-c049970", "shell": "cmd.exe", "pluginVersions": [ "@oclif/plugin-autocomplete 3.3.0 (core)", "@oclif/plugin-commands 4.2.0 (core)", "@oclif/plugin-help 6.3.0 (core)", "@oclif/plugin-not-found 3.3.0 (core)", "@oclif/plugin-plugins 5.5.1 (core)", "@oclif/plugin-search 1.3.0 (core)", "@oclif/plugin-update 4.8.0 (core)", "@oclif/plugin-version 2.3.0 (core)", "@oclif/plugin-warn-if-update-available 3.2.0 (core)", "@oclif/plugin-which 3.3.0 (core)", "@salesforce/cli 2.150.6 (core)", "agent 2.0.5 (core)", "apex 4.1.1 (core)", "api 2.0.9 (core)", "auth 5.0.6 (core)", "code-analyzer 5.16.0 (user)", "data 5.1.7 (core)", "deploy-retrieve 4.1.2 (core)", "info 4.0.9 (core)", "limits 4.0.4 (core)", "marketplace 2.0.5 (core)", "org 6.0.11 (core)", "packaging 3.0.6 (core)", "schema 4.0.6 (core)", "settings 3.0.6 (core)", "sobject 2.0.5 (core)", "telemetry 4.0.6 (core)", "templates 57.0.11 (core)", "trust 4.0.10 (core)", "user 5.0.2 (core)", "sfdx-git-delta 6.45.1 (user)" ] }