Skip to main content
Version: 4.1 (2026 H2)

Field Inheritance and Field Locks

Users, organizational units and profiles hold their data in fields. This page describes where a field takes its value from, how a field lock affects the levels below it, and which limitations currently apply.

Basic principle​

Inheritance is not a stored state — it is recalculated every time the data is loaded. The only rule is:

  • A field row exists — the field has its own, manually set value.
  • No field row exists — the field inherits.

What counts is the field row, not its content: a deliberately empty value is a field row of its own and overrides the inherited value. The field stays empty even though a value exists further up.

Two consequences follow, and they are essential for understanding the whole model:

  • Every rule applies per combination of field definition and document language, never per object. A profile can inherit the field "Phone" and at the same time have "Function" set manually — in the same language.
  • The Inherit from parent function deletes the field's own row. The field then inherits again. There is no separate reset state.

Inheritance chain​

Field inheritance chain Grid with two columns (default language, additional document language) and two object rows (user, profile). The directory service supplies the user's values through user synchronization: without a language into the default language, with a language directly into that language. Within a row, the additional language inherits from the default language of the same object. In each column, the profile inherits from the user in the same language. For the profile's additional language: first from its own default language if a value is set there manually; otherwise from the user in the same language. Default language Setting of the datasource Additional document language e.g. French Directory service User for organization fields: organizational unit incl. parent units Profile AD / Entra ID User synchronization User default language User additional language Profile default language Profile additional language value without language value with language from the default language from the user from the default language from the user 1 2 An arrow applies only if the target cell has no manually set value. First from its own default language, if a value is set there manually. Otherwise from the user, in the same language. 1 2

Rows are the objects, columns the document languages. Each arrow only takes effect if no own field row exists in the target cell for that field definition.

The yellow cell is the switch. For an additional document language of the profile:

  1. First from its own default language (horizontal): if the profile has its own field row there, that row supplies the value.
  2. Otherwise from the parent object (vertical): the value comes from the user or the organizational unit in the same language.

Dashed is the special case where a value from user synchronization carries a language (lcid) and therefore lands directly in that document language of the user.

User fields and organization fields are separate field definitions: a profile takes a user field from the user and an organization field from the organizational unit, including its parent units. Inheritance follows the same pattern in both cases; the diagram shows it for the user.

Order: horizontal before vertical​

Within an object, inheritance is applied horizontally first — from the default language into the object's remaining document languages. Only then does vertical inheritance from the parent object take effect. Horizontal inheritance wins.

Practical consequence: as soon as a profile field is set manually in the default language, the profile's additional document languages take their value from there — no longer from the user or the organizational unit.

Where a profile field takes its value from​

Profile, default languageProfile, additional languageSource for the default languageSource for the additional language
inheritsinheritsUser or organizational unit, default languageUser or organizational unit, same language
set manuallyinheritsProfile itselfProfile, default language
inheritsset manuallyUser or organizational unitProfile itself
set manuallyset manuallyProfile itselfProfile itself

Default language​

The default document language is a datasource setting (DefaultDocumentLanguage in the Dashboard under Settings → General Settings). There is exactly one, and it applies to all users, organizational units and profiles of the datasource.

Terms such as "the user's default language" or "the profile's default language" therefore refer to the same language in different roles of the inheritance chain — not to two configurable values. This is distinct from the document language a user selects in the client: that setting only controls which language variant is used when a document is created. See Languages.

Interaction with user synchronization​

  • Only active user field definitions with a populated external reference are synchronized. Field definitions without an external reference are left untouched by synchronization.
  • Synchronization is a write operation, not a live reference: it populates the user's field row. After that, the value is the user's own value. There is no marker indicating "taken from the directory service".
  • Without an lcid attribute, a claim ends up in the default document language; with lcid it goes directly into the specified language. See User synchronization — Multilingualism.
  • With skipLockedFields="true", synchronization does not overwrite locked user fields.

Field locks​

A lock is set on a user field or on an organization field. It does not mean "pass the value down and protect it" — it means: the diverging values further down are deleted.

When a lock is saved, the server removes the field row of the same field definition and the same document language

  • from all profiles of the user, if a user field is locked,
  • from all subordinate organizational units and their profiles, if an organization field is locked — recursively across the entire hierarchy.

This results in three characteristics:

  • Per language. A lock in French affects French only. The field's other document languages are unaffected.
  • Unconditional. The value is deleted regardless of whether it was inherited or set manually on the target level.
  • Can only be released at the source. No record remains on the inheriting level, so there is nothing there to unlock. Locks cannot be set on a profile at all.
warning

Locking a field discards individually set contents of that field in all inheriting objects. For an organization field on a parent unit, this affects the entire hierarchy below it. The discarded contents cannot be restored.

Preventing field editing in general​

Independently of the lock, the field definition can specify whether a field is editable in the user or in the profile at all. Unlike the lock, this flag does not delete any values; it only controls whether the field is offered for editing.

Current limitations​

Value inheritance and horizontal inheritance are implemented in primedocs Desktop and primedocs Web and produce the same result. Differences exist for field locks and for the origin hints:

Capabilityprimedocs Desktopprimedocs Web
Value inheritance user / organizational unit → profileimplementedimplemented
Horizontal inheritance into additional document languagesimplementedimplemented
Setting and releasing locksimplementednot planned
Displaying and enforcing lockspartialnot implemented
Naming the origin of a valuepartialpartial
  • Field locks in primedocs Web. primedocs Web currently does not evaluate the lock information. A profile field locked from above appears there as inherited and editable and can be given its own value again; the lock does not restore itself. Field locks are therefore only reliable where the affected users work with primedocs Desktop. Only the users' own user and profile data is affected.
  • Field definition flags. Whether a field is editable in the user or in the profile is evaluated by both clients for the user interface, but it is not checked on the server when saving.
  • Profile without an organizational unit. primedocs Desktop locks all organization fields in this case. primedocs Web does not display any organization fields and leaves them open.
  • Multilingual organization fields. If the same organization field is maintained on an organizational unit in several document languages, primedocs Web currently takes only one of the language variants into account.
  • Origin hints. primedocs Desktop names the source object and the source language, but is not accurate in all cases. primedocs Web only distinguishes between "Taken from the main language" and "Taken from the user settings", and labels values inherited from an organizational unit as user values.

Further reading​