Make forms Read only for a group of people for all cmdb ci tables

Devi Dodda
Tera Contributor

‎10-19-2023 12:42 AM

As an L1 Technician group person  I can modify the CMDB this seems to be incorrect ,so i need make forms read only for that group for all cmdb ci tables 

 

here i cannot use ACL's 

 

could you please anyone suggest best way to do complete this requirement

 

0 Helpfuls
  • 261 Views
2 REPLIES 2

Niklas Peterson
Mega Sage
Mega Sage

‎10-20-2023 07:38 AM - edited ‎10-20-2023 07:50 AM

Hi,
Why can't you use ACLs?

 

I personally prefer to create a role structur that provides roles that enable access to manage CIs per CI class or groups of CI classes. That enable me to delegate the responsibility to manage CIs to different groups. I also usually lock the ACLs down so that not only you need to have the role but you must also be part of the Managed by Group. This makes it possible for groups to have CIs in the same classes but not able to manage each others CIs. I would also recommend a to have a "Global" configuration management role that has access to all CI Classes.

Out of the box itil and asset role has the access but I usually limit that to read.

 

Regards,
Niklas

0 Helpfuls

Alka_Chaudhary
Mega Sage
Mega Sage

‎10-20-2023 08:33 AM

Hello @Devi Dodda ,

You can create UI policy on table example - cmdb_ci_computer

In script section, check the run script check box.

Write a script and make a ajax call. Refer to below script:-

function onCondition() {
    var checkMember = new GlideAjax("CheckMemberOfGroup");
    checkMember.addParam('sysparm_name', "iSMemberOfGroup");
    checkMember.getXML(callbackFunction);

    function callbackFunction(response) {
        var answer = response.responseXML.documentElement.getAttribute("answer");
        if (answer == 'true') {
            alert(answer);
            var fields = g_form.getEditableFields();
            for (var x = 0; x < fields.length; x++) {
                var field = g_form.getValue(fields[x]);
                g_form.setReadOnly(fields[x], true);
            }
        }
    }
}

Create Script include with name 'CheckMemberOfGroup' and make it client callable.

And, write the below script and replace the group name with correct group name:-

var CheckMemberOfGroup = Class.create();
CheckMemberOfGroup.prototype = Object.extendsObject(AbstractAjaxProcessor, {
    iSMemberOfGroup: function() {
        var result = gs.getUser().isMemberOf('L1 Technician');//give the correct Group Name Here
        return result;
    },
    type: 'CheckMemberOfGroup'
});

Please Mark my answer Helpful & Accepted if I have answered your question.

Thanks,

Alka

0 Helpfuls