ACL & Admin Overrides

[kyren_cooper]

Hello guys,

was wondering if anyone would be able to help me out. I created a role called escalation_admin and I've then since added some ACLs to a field for Write and List_edit which require that role.

I've ensured that Admin override was set to false but when looking at the fields as an Admin they still appear to be changed despite my admin account not having the escalation_admin role I've created and delegated in the ACL. My goal was to restrict this to everyone including admins unless they had the escalation_admin role.

Can I get some guidance on what I'm doing wrong?

Thanks all

[Andras Kisgyorg · Accepted solution]

Hi Kyren,

This is because admin users pass role checks.

That's why basing your ACL only upon role checks would not be efficient when it comes to managing admins access,

and we have to keep in mind that admins are in control of the platform, they can grant roles to themselves, manage group memberships and ACLs.

Despite that, to make this work for this use case, you need to create an ACL which has additional conditions beyond only role checks.

You may consider creating a group for your escalation admins, and do a group check in your ACL script on top of the role check in the Requires role related list:

answer = gs.getUser().isMemberOf('Escalation Admins');

Hope this helps.

Cheers,

[kyren_cooper]

Hero!

With a combination of both your help this has worked! The script used is at the bottom. When testing using an Admin account the following is now read only.

Many thanks to the two of you!

if (gs.getUser().isMemberOf('Escalation Admins'))

  {

  answer = true;

}

else {

  answer = false;

}

[Rishi18]

Just wondering what's the use of "admin overrides" checkbox if admin will override whether it is true or false?

[kyren_cooper]

Something I was also wondering at the time! if/when someone finds out the purpose of an "Admin Override" check box within ACL's please let us know!