Package Install with AdminsOnly option is changing all the profiles

[ar-srinivas]

Summary

When we run sfdx force:package:install -p <*****> -b 0 -u <****> --apiversion=55.0 -r -s AdminsOnly --json it should install and change the profile of the admin but it is changing the non admin profiles and also assigning the @@permissions. When we do the same from a browser and selecting AdminsOnly option it is changing only the admin profile.

Steps To Reproduce:

Run sfdx force:package:install -p <*****> -b 0 -u <****> --apiversion=55.0 -r -s AdminsOnly --json and see the profiles modified. It changes are non admin and admin profiles

Expected result

It should modify only the admin profiles

Actual result

Updating admin and non admin profiles

System Information

We have seen this behaviour starting from 7.180 to the latest 7.190

{
"cliVersion": "sfdx-cli/7.190.2",
"architecture": "darwin-x64",
"nodeVersion": "node-v18.14.1",
"pluginVersions": [
"@oclif/plugin-autocomplete 2.1.2 (core)",
"@oclif/plugin-commands 2.2.10 (core)",
"@oclif/plugin-help 5.2.5 (core)",
"@oclif/plugin-not-found 2.3.20 (core)",
"@oclif/plugin-plugins 2.3.2 (core)",
"@oclif/plugin-search 0.0.13 (core)",
"@oclif/plugin-update 3.1.5 (core)",
"@oclif/plugin-version 1.2.1 (core)",
"@oclif/plugin-warn-if-update-available 2.0.28 (core)",
"@oclif/plugin-which 2.2.16 (core)",
"alias 2.2.2 (core)",
"apex 2.2.0 (core)",
"auth 2.7.1 (core)",
"community 2.2.3 (core)",
"config 1.5.1 (core)",
"custom-metadata 2.1.3 (core)",
"data 2.3.1 (core)",
"info 2.4.4 (core)",
"limits 2.3.5 (core)",
"org 2.4.2 (core)",
"packaging 1.15.0 (core)",
"schema 2.3.1 (core)",
"signups 1.4.3 (core)",
"source 2.5.4 (core)",
"telemetry 2.1.1 (core)",
"templates 55.4.1 (core)",
"trust 2.4.2 (core)",
"user 2.3.2 (core)",
"@salesforce/sfdx-plugin-lwc-test 1.0.1 (core)",
"@salesforce/sfdx-scanner 3.10.0 (user)",
"sfdx-codescan-plugin 1.0.8 (user)"
],
"osVersion": "Darwin 22.3.0",
"shell": "zsh",
"rootPath": "/Users/srinivas.s/.local/share/sfdx/client/7.190.2-cd6cf69"
}
``

If you are using sfdx
Run `sfdx version --verbose --json`
If you are using sf
Run `sf version --verbose --json`
Paste the output here
Additional information

Feel free to attach a screenshot.

[owned by another team](https://github.com/forcedotcom/cli/labels/owned%20by%20another%20team)

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[github-actions]

We have determined that the issue you reported exists in code owned by another team that uses only the official support channels. To ensure that your issue is addressed, open an official Salesforce customer support ticket with a link to this issue. We encourage anyone experiencing this issue to do the same to increase the priority. We will keep this issue open for the community to collaborate on.

[ar-srinivas]

@georgeslater @davidmreed I could see this issue exist even in SF CLI (1.x) version(Earlier was facing in sfdx CLI). Is there any fix provided for this issue? If yes, please give the version number to which I need to update.

[shetzel]

@ar-srinivas - can you please uninstall any old CLIs (sfdx v7 or sf v1) then install the latest sf (v2) and try your flow again? Ensure you're using a recent (or latest) packaging plugin version as well.

[ar-srinivas]

@shetzel I have uninstalled sfdx v7 and sf v1 and installed the latest sf CLI 2.14.6 but still facing the same issue.

Identity User - A non admin profile impacted after installing a package with AdminsOnly option. See the screen shot where the apex class, custom permissions are added.

[ar-srinivas]

@shetzel Could you please let me know if you have any further findings on this issue?

[ar-srinivas]

sf package install -p -b 0 -a all -s AdminsOnly -t Mixed -o --api-version=57.0 -r --json

sf package install -p -b 0 -a all -s AdminsOnly -t Mixed -o --api-version=55.0 -r --json

Only the API version makes the difference on the install. With 55, we could see the package installs for all users and with 57 it installs only for Admins.

[shetzel]

@ar-srinivas - I don't have any updates for this. I'll try to get an answer from the packaging team soon. However, if the API version changes the behavior, that indicates a server side change and not related to CLI code. If you want a quicker response from the packaging team you should open a support case. If using API version 57.0 fixes this for you then I would just use that if you can.

[shetzel]

This appears to be fixed in current server side code so closing this. If it's still a problem, the best and fastest way to a workaround or solution is to open a support case for the packaging experts.