ACLs bug

[arturito]

Hi 
I am experiencing a weird issue with ACLs impersonating users. I have a table, access to which requires a "user" role. This role is assigned automatically to a customer after he fills the form and submits it with before business rule. The role is assigned to user, I can even see the info message, but trying to reach a table page right after shows the error "Security constraints prevent access to requested page". When I finish an impersonation and start it once again, everything works as expected. Here is code of business rule: 

(function executeRule(current, previous /*null when async*/ ) {

    var pumpersTb = 'x_1124584_mypump_pumpers';
    var groupTb = 'sys_user_grmember';
	var endUserGroup = "60c9afdf47e94210208d1a2f316d435c"
    var url = "https://dev192434.service-now.com/now/nav/ui/classic/params/target///x_1124584_mypump_pump_progress.do%3Fsys_id%3D-1%26sysparm_stack%3Dx_1124584_mypump_pump_progress_list.do";

    //checks if user record already exists in table
    var pumpGr = new GlideRecord(pumpersTb);
    if (pumpGr.get('user', current.user)) {
        current.setAbortAction(true);
        return gs.addErrorMessage('Current user is already part of MyPump community');
    }
	// adds user a group for access
    var addGroupGr = new GlideRecord(groupTb);
    addGroupGr.initialize();
    addGroupGr.user = current.user.sys_id;
    addGroupGr.group = endUserGroup;
    addGroupGr.insert();
	return gs.setRedirect(url);

})(current, previous);

[James Chun · Accepted solution]

Hi @arturito,

The new role takes effect after starting a new session, meaning the user needs to log out and log back in.

Cheers

[arturito]

Thanks for the answer and can i change this behaviour somehow?

[arturito]

Hi @James Chun , thanks for the answer
Is it possible to change this behaviour?

[James Chun]

Hi @arturito,

Unfortunately, I don't think this is possible.

A few options to explore:

• Terminate the user's session via script. But this won't look good from the user experience perspective
• Add an info message to the user asking to log out and log back in
• Use a non-session-bound attribute. For example, instead of using a role, control access via a group.

I would recommend the 2nd option as it's least intrusive and/or requires no additional configuration.

Cheers