Symptom
- Permissions for MDF objects are not functioning as expected when configured with time-based restrictions.
- Users with "Edit" permissions set to a specific time range (e.g., 12 months) are able to edit all records, regardless of the time restriction.
- "View" permissions configured as "Full" override the time-based restrictions for "Edit" permissions.
Environment
-
SAP SuccessFactors HCM Core
-
SAP SuccessFactors HCM Suite
Reproducing the Issue
- Create MDF parent-child objects with time-based restrictions.
- Assign "View all" permissions to one role and "Edit" permissions restricted to a specific time range (e.g., 12 months) to another role.
- Test the roles independently:
- Users with "Edit" permissions restricted to 12 months can only view and edit records within the specified time range.
- Users with "View all" permissions can view all records.
Cause
The system is designed so that "View" permissions take precedence over "Edit" permissions. Assigning "View all" overrides the time-based restrictions applied to "Edit" permissions.
Resolution
- Confirm that this behavior is expected and aligns with the system design.
- If stricter control is required, avoid assigning "View all" permissions to roles that also have time-based "Edit" restrictions.
- Refer to SAP's Influence Opportunity Homepage to submit enhancement requests for additional functionality.
Keywords
mdf object permissions, time-based restrictions, view all, edit permissions, sap successfactors, meta data framework, permissions override, object definition, field-related issues , KBA , LOD-SF-MDF-RBP , RBP Permissions on Objects , Problem
Product
SAP SuccessFactors HCM Core all versions ; SAP SuccessFactors HCM Suite all versions
SAP Knowledge Base Article - Public