SAP Knowledge Base Article - Public

3041852 - SAC - Data locking owner able to unlock and edit data even when parent locked

Symptom

Users assigned as data lock owners to a slice of data seem to be capable of changing the status from "Locked" to "Open" or "Restricted", even if parent dimension members which include that slice of data are still set to "Locked". Once the data lock owner has changed the status to "Open" or "Restricted", they are then able to change the data, even if that causes the the overall value at the parent level to change as well.

Environment

SAP Analytics Cloud Version 2021.2.8

Cause

This is a behavior by design of the product with some Limitations

Resolution

Below some of the aspects of the data locking functionality:

1. Locks states on non leaf nodes are inferred based on the locks states of the children. That means:

  • The lock state of the DAN_OPS for example is summed up based on the lock states of DAN_GLOBAL, GRPBAL_MED and  AMERICAS. In the similar way the locks state of AMERICAS is based on the lock states on its children
  • If all the children of a node have the same lock state, the parent node has exactly the same lock state.
  • If the children have different lock states, the parent will have a so called MIXED states (also marked as read-only in the story for the data entry)

2. Changing/Setting a lock state on the parent node will push down the locks to the children, where they will be in fact also persisted.

  • Similarly, changing a lock state on the lower levels will have an impact on the higher levels. That is, we do not have locks for the higher level nodes independent of the locks from the levels underneath. 

We have designed it in this way as you all your data as stored at the leaf levels and aggregated up the hierarchies. Essentially it would make no sense to have node being LOCKED while one or more of their children are OPEN: if you would edit such a open child, the data would be aggregated upwards anyway and the value  of the "LOCKED" parent would change anyway. If you are looking for a mechanism that would aim to force the user to edit only on lower levels than you should consider Data Access Control (https://help.sap.com/doc/00f68c2e08b941f081002fd3691d86a7/2021.2/en-US/b46f2f74aea04c399ccb5c9b1bcc225e.html?css=https://dentsu.eu10.hcs.cloud.sap/sap/fpa/services/rest/epm/feature/css?tenant=3) or Value Locks (https://help.sap.com/doc/00f68c2e08b941f081002fd3691d86a7/2021.2/en-US/8c9f7d54715e4c8a9964b6b4ddc1870d.html).

With respect to the ownership, this is meant to:

1. Allow the users to edit data for slices marked s RESTRICTED (which becomes for owners and managers essentially OPEN)

2. Offer restrictive permissions wrt who can change a lock state. That is:

  • An owner of a slice can change the lock state in direction OPEN -> RESTRICTED -> LOCKED but not in the other direction 
  • A manager can change the lock state in both directions

It is important to note:

1. An owner of a node becomes a manager of all children.

2. If you set an owner of a non-leaf node:

  • the user will become a manager of the children, meaning that the user is allowed to change locks freely
  • as it can change locks freely for the children and the lock state of the parent is inferred based on the locks of the children, it essentially means that the user can change locks freely for the owned node as well. So owners of non-leaf nodes become essentially  managers of those nodes, while owners of leaf nodes stay just owners of these nodes.

And this is why the user can set the locks states back to open. As the user owns non-leaf node implicitly becomes a manager , hence the user can change the locks state to OPEN. We are currently working to extend this feature and provide a  more restrictive handling of such cases but this is still in inception phase and not yet on any roadmap.

See Also

Your feedback is important to help us improve our knowledge base.

Keywords

SAP Cloud for Planning , sc4p , c4p , cforp , cloudforplanning , Cloud for Analytics , Cloud4Analytics , CloudforAnalytics , Cloud 4 Planning , BOC , SAPBusinessObjectsCloud , BusinessObjectsCloud , BOBJcloud , BOCloud. , SAC , SAP AC , Cloud-Analytics , CloudAnalytics , SAPCloudAnalytics , by design , limitation , DL, Data Locking, leaf, parent, status, , KBA , LOD-ANA-PL-DLK , Data Locking , Problem

Product

SAP Analytics Cloud 1.0