Migrate Your Salesforce Sharing Settings to Wave

Sharing inheritance creates a bridge between your Salesforce security model and Wave. No more security predicates needed for supported objects.

As a Salesforce admin, you have likely labored over security, setting up sharing rules so that your users have access to data appropriate to their role. Setting up a working security model for your org is no small feat. Your company has invested a lot of time and money to get this right. But what about Wave Analytics?

Wave Analytics has its own row-level security solution—security predicates. They work well, but Wave administrators have to carefully replicate their Salesforce security settings. But who wants to set up security twice?

Wave administrators no longer need to use security predicates to replicate row-level security settings in Salesforce. Now you can enable the sharing inheritance feature in Wave and specify which objects use it when creating datasets during the Extract Load and Transform process. Your Salesforce sharing settings are honored in Wave, and you don’t have the overhead of maintaining two distinct security models.

Is Sharing Right for My Wave Org?

As with any new feature, we recommend that you thoroughly test sharing inheritance in a sandbox environment before rolling out to production. Test against your org’s security model, data and use cases. Complex security models in which users have access to a large number of rows can have performance implications. It's important to test your particular use cases to make sure sharing inheritance works for you.

In this first stage of a phased roll out of sharing for Wave, we support five of the most heavily used objects: Accounts, Opportunities, Orders, Cases, and custom objects. Other objects—such as Campaign, Idea, Site, and so on—still need to use security predicates.

Sharing isn't automatically applied to all datasets, and it isn't applied by default to new datasets. You must apply the sharing feature to each dataset manually. If an existing dataset has a security predicate, sharing won't override it. A dataset can use either sharing or a security predicate, but not both.

Getting Started

To enable sharing in Wave:

  1. From Setup, enter Wave in the Quick Find box, then select Settings under Wave Analytics.
  2. Select Enable Wave Sharing Inheritance and click Save.

    Page with various config checkboxes, one of which is for enabling Sharing.

  3. Add "rowLevelSharingSource" to the "sfdcRegister" node parameters for dataflows. See the Wave sfdcRegister help page for details.

    The rowLevelSharingSource property takes a string, which should be an API name for the object from which sharing should be inherited for the dataset. In the following example, the property specifies that the Salesforce sharing rules on the Opportunity object should be inherited.

    "Register_Opportunity":{  
      "action":"register",
      "parameters":{  
         "label":"Opportunity with Security",
         "name":"Opportunity_with_Security",
         "rowLevelSharingSource":"Opportunity"
      },
      "sources":[  
         "Extract_Opportunity"
      ]
    }

    You can also use the REST API to do the same thing. The sharingSource property on the /wave/datasets/${datasetId}/versions/${versionId} endpoint specifies the object from which sharing rules are inherited for that dataset version.

Sharing inheritance or security predicate settings are used by the dataflow for the first run—when the first dataset version is created. To make subsequent changes, edit the settings on the current dataset version.