Why some records are visible in the report even if the master record is not shared with that user?
|Knowledge Article Number||000182017|
|Description||a custom object named "child" is the child object of two master-detail relationships with the objects "Parent A" and "Parent B".
The affected user can review a child object record and both related "parent A" (primary relationship) and "parent B" (secondary relationship) records in a report, but he does not have access to the "parent B" record.
The report is a custom report type on the child object only and retrieves via lookup the related parent A and parent B fields.
|Resolution||As you can see on the article "Considerations for Relationships", the first master-detail relationship created is considered to be the primary relationship and will decide which child record is shared with the user.
The report type on the child object that retrieve via lookup the parent information, will evaluate if the child object is shared and provide the data accordingly.
But if the user clicks on the link of the parent record he has no access to, he will receive the "insufficient privileges" error message as expected (as the record is not shared with him).
The same error message will be showed if the user try to access the child record itself, as the user has access but the secondary master-detail relationship will be enforced and remove this access.
The Junction object record will be visible under related list, list views and detail page only if the user has at least read access to both the master records.
The resolution would be to create a report type on "parent B with child" and add via lookup the fields of the parent A object. This way the secondary master-detail relationship sharing will be enforced by the report.