Permission Set Groups Cause Deploy Failure in Namespaced Scratch Org

Bilal-Z commented 1 year ago

Summary

When attempting to deploy metadata with extracted from a dev org with no namespace to a scratch org with a namespace, the deploy fails due to permission set groups with the following error:

PS C:\Users\bilal\Documents\XYZ-Project> sfdx force:source:push 
*** Pushing v55.0 metadata with SOAP API v53.0 connection *** 
DEPLOY PROGRESS | ████████████████████████████████████████ | 99/99 Components 
=== Component Failures [1] 
Type Name Problem 
───── ───────────────────────── ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 
Error FSC_Community_Permissions Cannot create permission set group components since the following permission set names are invalid: XYZ_for_Community

Contents of FSC_Community_Permissions.permissionsetgroup-meta.xml are as follows:

<?xml version="1.0" encoding="UTF-8"?>
<PermissionSetGroup  xmlns="http://soap.sforce.com/2006/04/metadata">
<description></description>
<hasActivationRequired>false</hasActivationRequired>
<label>FSC Community Permissions</label>
<permissionSets>XYZ_for_Community</permissionSets>
<permissionSets>force__FinancialServicesForCmtyExtension</permissionSets>
<status>Updated</status>
</PermissionSetGroup>

manually editing FSC_Community_Permissions.permissionsetgroup-meta.xml and prepending the namespace of the target scratch org, like as follows:

<permissionSets>Example_Namespace__XYZ_for_Community</permissionSets>

fixes the issue.

Expected result

Metadata should be deployed successfully. the cli should recognize the permission set XYZ_for_Community reference in FSC_Community_Permissions.permissionsetgroup-meta.xml as the permission set defined in XYZ_for_Community.permissionset-meta.xml that has been added to deploy queue as Example_Namespace__XYZ_for_Community

Actual result

Deployment fails with the error message Cannot create permission set group components since the following permission set names are invalid: XYZ_for_Community.

System Information

{
        "cliVersion": "sfdx-cli/7.150.0",
        "architecture": "win32-x64",
        "nodeVersion": "node-v16.15.0",
        "pluginVersions": [
                "@oclif/plugin-autocomplete 0.3.0 (core)",
                "@oclif/plugin-commands 1.3.0 (core)",
                "@oclif/plugin-help 3.3.1 (core)",
                "@oclif/plugin-not-found 1.2.6 (core)",
                "@oclif/plugin-plugins 1.10.11 (core)",
                "@oclif/plugin-update 1.5.0 (core)",
                "@oclif/plugin-warn-if-update-available 1.7.3 (core)",
                "@oclif/plugin-which 1.0.4 (core)",
                "@salesforce/sfdx-plugin-lwc-test 0.1.7 (core)",
                "alias 2.0.0 (core)",
                "apex 0.11.0 (core)",
                "auth 2.0.2 (core)",
                "community 1.1.4 (core)",
                "config 1.4.6 (core)",
                "custom-metadata 1.1.0 (core)",
                "data 0.6.15 (core)",
                "generator 2.0.0 (core)",
                "info 2.0.0 (core)",
                "limits 2.0.0 (core)",
                "org 1.12.1 (core)",
                "salesforce-alm 54.3.0 (core)",
                "schema 2.1.0 (core)",
                "sfdx-cli 7.150.0 (core)",
                "sfdx-falcon 0.0.93",
                "signups 1.0.0 (core)",
                "source 1.9.7 (core)",
                "telemetry 1.4.0 (core)",
                "templates 54.6.0 (core)",
                "trust 1.1.0 (core)",
                "user 1.7.1 (core)"
        ],
        "osVersion": "Windows_NT 10.0.22621"
}

github-actions[bot] commented 1 year ago

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

git2gus[bot] commented 1 year ago

This issue has been linked to a new work item: W-12081228

mattmartin26 commented 1 year ago

We are experiencing the same issue. Will attempt namespace injection (using CumulusCI) and report back if a successful workaround.



Exception in task install_2gp_commit.install_managed        

Error: (Chancery_Administrator) Cannot create permission set group components 
since the following permission set names are invalid: Agreements_Management, 
Assignments_Management, Chancery_Core_App, Committees_Management, 
Sacraments_Management_Diocese, 

Details: Chancery_Administrator: Cannot create 
permission set group components since the following permission set names are 
invalid: Agreements_Management, Assignments_Management, Chancery_Core_App, 
Committees_Management, Sacraments_Management_Diocese```

aesanch2 commented 1 year ago

@mattmartin26 did you have any success with namespace injection?

aozomaro commented 1 year ago

Did this issue go anywhere?

mwannamaker41 commented 11 months ago

Would be nice to get an update on this issue and the workitem that was created. This is still a problem for me.

WillieRuemmele commented 5 months ago

sorry to let this thread die. But looking into it now

WillieRuemmele commented 5 months ago

Has anyone attempted to use our string replacement feature with this? I was able to get it working with this permission set group example

I added this bit to the sfdx-project.json

  "replacements": [{
    "filename": "force-app/main/default/permissionsetgroups/test.permissionsetgroup-meta.xml",
    "stringToReplace": "set1",
    "replaceWithEnv": "REPLACE"
  }],

 ➜  REPLACE='cristiand391__set1' sf project deploy start --source-dir force-app/main/default/permissionsetgroups/test.permissionsetgroup-meta.xml
Deploying v60.0 metadata to test-v0v0u71t3xst@example.com using the v61.0 REST API.
Deploy ID: 0Af9A00000frdFoSAI
Status: Succeeded | ████████████████████████████████████████ | 1/1 Components | Tracking: 0/0

Deployed Source
===============================================================================================================
| State     Name Type               Path                                                                        
| ───────── ──── ────────────────── ─────────────────────────────────────────────────────────────────────────── 
| Unchanged test PermissionSetGroup force-app/main/default/permissionsetgroups/test.permissionsetgroup-meta.xml

and then without it,

 ➜  sf project deploy start --source-dir force-app/main/default/permissionsetgroups/test.permissionsetgroup-meta.xml
Deploying v60.0 metadata to test-v0v0u71t3xst@example.com using the v61.0 REST API.
Deploy ID: 0Af9A00000frdFeSAI
Status: Failed | ████████████████████████████████████████ | 1/1 Components | Errors: 1

Component Failures [1]
=================================================================================================================================
| Type  Name Problem                                                                                                  Line:Column 
| ───── ──── ──────────────────────────────────────────────────────────────────────────────────────────────────────── ─────────── 
| Error test Cannot create permission set group components since the following permission set names are invalid: set1

In the documentation we have examples for replacing certain strings for certain environments, which would probably be the most applicable example to follow

forcedotcom / cli