function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
Peter TheodorePeter Theodore 

Insufficient access on cross reference id

Hi all,

I'm a bit stumped here, so hoping y'all can help me out. I've created a trigger on the Case object to fire the assignment rules and auto-response rules when a case is submitted from our Community (it's an unauthenticated community, so all cases coming in are using the Site Guest User for case submission). The code as it exists below works 100% of the time: 
 
trigger CaseAssignment on Case (after insert) {
    //Variable decleration
    List<Case> caseList = new List<Case>();
    User communityUserObj = new User();
    User adminUserObj = new User();
   
    if(Trigger.isAfter && Trigger.isInsert){
        //Fetching the integration user details
        communityUserObj = [SELECT Id, Name, Alias FROM User where Alias = 'scguest' LIMIT 1];
        adminUserObj = [SELECT Id, Name, Alias FROM User where Alias = 'peter' LIMIT 1];
           
        for (Case caseObj : Trigger.new) {
            if (UserInfo.getUserId()  == communityUserObj.Id || UserInfo.getUserId() == adminUserObj.Id) {
                caseList.add(new Case(id = caseObj.id));
            }
        }
   
        Database.DMLOptions dmo = new Database.DMLOptions();
        dmo.assignmentRuleHeader.useDefaultRule = true;
        Database.update(caseList, dmo);
    }
}
However, when I add the highlighted line of code, the user on the Community page gets an "Insufficient access on cross reference id" error:
 
trigger CaseAssignment on Case (after insert) {
    //Variable decleration
    List<Case> caseList = new List<Case>();
    User communityUserObj = new User();
    User adminUserObj = new User();
   
    if(Trigger.isAfter && Trigger.isInsert){
        //Fetching the integration user details
        communityUserObj = [SELECT Id, Name, Alias FROM User where Alias = 'scguest' LIMIT 1];
        adminUserObj = [SELECT Id, Name, Alias FROM User where Alias = 'peter' LIMIT 1];
           
        for (Case caseObj : Trigger.new) {
            if (UserInfo.getUserId()  == communityUserObj.Id || UserInfo.getUserId() == adminUserObj.Id) {
                caseList.add(new Case(id = caseObj.id));
            }
        }
   
        Database.DMLOptions dmo = new Database.DMLOptions();
        dmo.assignmentRuleHeader.useDefaultRule = true;
        dmo.EmailHeader.triggerAutoResponseRule = true;
        Database.update(caseList, dmo);
    }
}
I've checked all of my permissions for the Guest User and everything is working as it should, but I feel there's a permission or setting I'm missing that would get me around this error. I don't think it's a mixed DML issue, because I'd be getting that error instead, right? Any insight you have would be appreciated. Thanks!

 
Peter TheodorePeter Theodore
Sorry, the highlighted line didn't come through when I pasted the snippet. The line of code that's causing the error is:
 
dmo.EmailHeader.triggerAutoResponseRule = true;

 
karthikeyan perumalkarthikeyan perumal
Hello, 

This error will  come coz of the below 2 ways. 

1)  
The error is basically coming due to sharing the inserted record back with the owner of the record who has full permissions on it.
 
If you see while creating the record, the logged in user is the owner as well as Branch Manager of the record. Then in the trigger its again shared back with the Branch Manager who is the owner of the record.
Basically, you cannot restrict the access to the owner of a record.
 
I will suggest you to create a user and assign it to Branch Manager and then insert it. In the trigger share it with UserInfo.getUserId().


2)

When you try to update the data, you may face this issue. Kindly check the user profile and check whether the user has access to update that record. Even if the user has access, kindly check whether the user has access to update fields like record types.

Troubleshooting steps:

Check the user Profile.
Profile need to have access for the record types.


Hope this will help you , 

Thanks
karthik