Symptom
- Users are able to initiate a life event on behalf of other employees despite not having the "manage on behalf of employee" permission.
- Removing "view" permissions makes the entire benefits category disappear.
- The behavior is reproducible for all users within the same role configuration.
Environment
- SAP SuccessFactors Employee Central
- Global Benefits
Reproducing the Issue
- Log in as a user with access to proxy and role-based permission troubleshooting.
- Proxy as a user in an XXX role that has only “view on behalf of employee” for Benefits (no “manage on behalf of employee”).
- Open a target employee’s People Profile and navigate to the Benefits category.
- Observe that the user can see and initiate a Life Event for the employee.
Cause
- Users with only "View on behalf of Employee" permission were able to see and initiate Life Events despite not having "Manage on behalf of Employee" permission.
- The issue was in the Latest Benefits Overview permission evaluation path where the View permission was being incorrectly used to determine Life Event visibility.
Resolution
- A code fix has been delivered via BEN-23397.
- The fix ensures that the Life Event tile is only visible and actionable for users who have "Manage on behalf of Employee" permission for on-behalf scenarios, and "View Benefits" for self-service employees.
Note: In the 2611 release, we are introducing a revamped Life Event experience with new dedicated permissions. The fix from BEN-23397 will be patched as part of that release.
See Also
Keywords
life event, manage on behalf of employee, view on behalf of employee, benefits category, benefits overview, latest people profile, unauthorized initiation, global benefits, role-based permissions, rbp, life event tile, on-behalf action, permission evaluation, permission bug, view only , KBA , LOD-SF-EC-GBF , Global Benefits , Known Error
Product
SAP SuccessFactors Employee Central 2605 ; SAP SuccessFactors HCM Suite all versions
SAP Knowledge Base Article - Public