3792245 - Data Access Controls Not Working After User Attribute Trimming Fix

After upgrading to version 2026.19, customers report that their Data Access Controls (DAC) are no longer working as expected. Specifically:

• Users who previously had access to data based on permission entities are now unable to access that data;
• Permission entities that were working before the upgrade now fail to match users' attributes;
• The issue affects permission entities that use IDP custom attributes (custom1 through custom5) for data row-level security;
• The problem typically manifests when user attributes are defined as arrays in the IDP (e.g., ['Admin', 'Reader', 'Writer']);

Example Scenario:

• A permission entity was configured with value ' Reader' (with a leading space)
• Users with the Reader attribute could previously access the protected data
• After the upgrade, these users can no longer access the data 

• SAP Datasphere

Identify the affected permission entity:

• Ask the customer which permission entities stopped working after the upgrade
• Review the configured values in those permission entities

Check for workaround spaces:

• Examine the permission entity values for leading or trailing spaces
• Values like ' Reader', 'Writer ', or ' Admin' indicate the customer was using the workaround

Verify user attributes:

• Check the actual user attributes coming from the IDP
• Confirm they are defined as arrays (e.g., ['Admin', 'Reader', 'Writer'])
• After the fix, these values are now trimmed to 'Admin', 'Reader', 'Writer' (no spaces)

Confirm the mismatch:

• The permission entity with ' Reader' (with space) no longer matches the trimmed value 'Reader' (no space)
• This mismatch causes the data access control to fail

• This is a product issue

The customer needs to remove the workaround spaces they added to their permission entities:

Step 1:Identify Affected Permission Entities

• Review all permission entities that use IDP custom attributes (custom1-5)
• Look for values with leading or trailing spaces

Step 2: Update Permission Entity Values

• Edit each affected permission entity
• Remove all leading and trailing spaces from the attribute values
• Example: Change ' Reader' to 'Reader', ' Admin' to 'Admin', 'Writer ' to 'Writer'

Step 3: Save and Deploy

• Save the updated permission entities
• Deploy the changes to the affected data models/views

Step 4: Verify Access

• Ask users to log out and log back in (to refresh their session/token)
• Verify that data access controls now work correctly with the trimmed values

Important Notes:

• This is expected behavior after the fix was delivered
• The original issue (leading spaces in parsed attribute values) has been resolved
• Customers who didn't implement workarounds should not be affected
• The fix ensures consistent behavior: user attribute values no longer contain unwanted spaces

Root Cause: Previously, when IDP custom attributes were sent as arrays (e.g., ['Admin', 'Reader', 'Writer']), the parsing logic removed only brackets [] and commas, resulting in values with leading spaces (e.g., 'Admin', ' Reader', ' Writer'). Customers worked around this by adding artificial leading spaces to their permission entity values. The fix now applies TRIM() to remove both leading and trailing spaces, so workarounds must be removed.

• Use Identity Provider Attributes as Identifiers in Data Access Controls
• Data Access Control in SAP Datasphere – Operator and values
• Data Access Control in SAP Datasphere – Single value

datasphere, data access control, dac, identity provider attributes, custom schema, multi-value attributes, leading space, array values, attribute-based access control, abac, identity cloud services, operator and values, permissions table, custom application attributes, filtering , KBA , DS-SEC-DAC , Security – Data Access Control , Problem