"View Company Records" Permission Only Applies for Workflow Business Processes (BPs) (Doc ID 2905232.1)

Last updated on FEBRUARY 29, 2024

Applies to:

Symptoms

ACTUAL BEHAVIOR
---------------
Managed company users are able to view contracts of other managed company.


EXPECTED BEHAVIOR
-----------------------
Managed company users should not be able to view contracts of other managed company.

STEPS
-----------------------
The issue can be reproduced at will with the following steps:

1. Login into the impacted Unifier environment.
2. In the concerned Shell, in Contracts BP (simple BP, non-Workflow type), the user created 2 records. There are 2 managed companies in shell. Each contracts record will be assigned to either of the managed companies. Note: Managed company users should not be able to view contracts of other managed company. Thus, the managed company users are assigned to the concerned group and given the View Company Records permission only for the specific BP.
3. The specific contract belongs to the managed company, this managed company has 2 users. Thus, the ownership of contract is then transferred to user Creator. Record Creator DE value now changed to user of the managed company.
4. The user Creator is now able to view the specific record only, but the user Reviewer is not able to see the contracts record. Since the Record creator DE for the Contracts BP for the specific record is user Creator of the managed company, so user Reviewer should be able to view the record, but the user is not able to view this specific record.

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.