Best practice to make fields read only

[String]

Hi ,

we are doing inbound integration, so when we receive inbound json we are updating Incident state as in progress through REST API and we need to make the state field read-only.

how to make the state field read-only?

Please guide me 

[Rajesh Chopade1 · Accepted solution]

Hi @String 

Make A Field Read Only With A Client Script

This is going to be the option for people who are comfortable writing code, or want to get more experience in that area.

With a few lines of code, you can easily set one or many fields read only. This can be based off of the values of other fields, who a user is, or any sort of conditional logic that you can script out.

Remember that this is a client script, so it can only be used client side. This will not work in a Business Rule or Script Include.

To make a field read-only using a client script in ServiceNow, you can use the setDisabled method of the g_form object. Here is an example of how you can use this method to make a field read-only:

1. In the ServiceNow platform, navigate to the form that you want to modify.
2. Click on the “Customize” button in the top right corner of the form.
3. In the “Customize Form” window, click on the “Client Scripts” tab.
4. Click the “New” button to create a new client script.
5. In the “Script” field, enter the following code:

Replace “field_name” with the actual name of the field that you want to make read-only.

1. Click the “Save” button to save the client script.

This client script will run when the form is loaded, and it will use the setDisabled method of the g_form object to make the specified field read-only.

Alternatively, you can build some logic into this client script, to only make a field read only, under certain circumstances.

For example,

Note: You can also use the setReadOnly method of the g_form object to make a field read-only, but this method has been deprecated and is not recommended for use. The setDisabled method should be used instead.

When in doubt you should usually try to create a UI Policy/UI Policy Action, because it’s easier for people to go there than to look through code.

If you have ServiceNow admins that aren’t comfortable using code, then they won’t be able to go in and modify your scripts. But this all depends on your team and company.

Make A Field Read Only With An ACL

This is going to be the most secure way to make a field read only, by creating an ACL.

ACL’s can be created to allow/prohibit CRUD operations, based on a users role. These can apply to records, fields and tables.

Remember that you have to elevate your role to ‘security_admin’ to work with ACL’s.

So what is an ACL, in more detail?

An Access Control List (ACL) is a set of rules that determine whether a user or group has the ability to perform certain actions, such as reading, writing, or deleting records in a table. You can use an ACL to make a field read-only in ServiceNow by creating an ACL rule that denies write access to the field for the desired users or groups.

We can dive into the step by step process of how to create an ACL below.

Here’s how you can create an ACL rule to make a field read-only in ServiceNow:

1. In the ServiceNow platform, navigate to the “System Security > Access Control” menu.
2. Click the “New” button to create a new ACL rule.
3. In the “Name” field, enter a name for the ACL rule.
4. In the “Table” field, select the table that contains the field that you want to make read-only.
5. In the “Operation” field, select “Write”.
6. In the “Condition” field, enter a condition that specifies the field that you want to make read-only. For example, if you want to make the “field_name” field read-only, you can enter “field_name != NULL” in the condition field.
7. In the “Action” field, select “Deny”.
8. In the “Roles” field, select the roles or groups that you want to deny write access to the field.
9. Click the “Submit” button to save the ACL rule.

This ACL rule will deny write access to the specified field for the specified roles or groups, effectively making the field read-only for those users.

All access in ServiceNow is fundamentally controlled by ACL’s. By default ALL data in ServiceNow is locked down. You need to create ACL’s to open up and allow users to interact with this data.

There’s a really helpful ACL or Security Debugger tool in ServiceNow, that you can turn on to debug ACL’s.

Note: If you want to make a field read-only for all users, you can set the “Roles” field to “All” when creating the ACL rule. However, be aware that this will also make the field read-only for users with the “admin” role, so use caution when applying ACL rules to the “admin” role.

ACL’s can be difficult to manage and create, but there’s a lot of power in understanding how they work.

Let’s talk about UI Policies and how they can be configured to make fields read only in ServiceNow.

Make A Field Read Only With A UI Policy And UI Policy Action

These are the easiest and most straightforward to configure in ServiceNow.

Since they require no scripting and are super easy to build out – this should be your go-to when trying to figure out how to make a field readonly in a certain circumstance.

All you do is define the conditions, when a field should be read only, and then make a UI Policy Action, for each of the fields you’d like to make read only. All UI Policies are either true or false, and if it’s true – the related UI Policy Actions will be activated and kick in, doing whatever was set up.

You can make fields read only, visible and read only in a UI Policy Action.

Let’s talk about how you build them.

Here’s how you can create a UI Policy and UI Policy action to make a field read-only in ServiceNow:

1. In the ServiceNow platform, navigate to the “System UI > UI Policies” menu.
2. Click the “New” button to create a new UI Policy.
3. In the “Name” field, enter a name for the UI Policy.
4. In the “Table” field, select the table that contains the field that you want to make read-only.
5. In the “Condition” field, enter a condition that specifies when the UI Policy should be triggered. For example, you can enter a condition that specifies a specific field value, such as “state=Closed”.
6. In the “Actions” section, click the “New” button to create a new UI Policy action.
7. In the “Type” field, select “Read Only”.
8. In the “Fields” field, enter the name of the field that you want to make read-only.
9. Click the “Submit” button to save the UI Policy action.
10. Click the “Submit” button again to save the UI Policy.

This UI Policy will be triggered when the specified condition is met, and it will set the specified field to read-only using a UI Policy action.

It’s a simple as that.

It’s a great feature because it’s easy to setup and also to debug, if it ever comes to that.

I hope this will helps you

Thank you

Rajesh.

[String]

great explanation, Thanks @Rajesh Chopade1 

[Kristin Acree]

i'd like to add a small add on to the Client Script one. You cant set a field as read only or disabled if it is required. so you will need to something like this: 

        g_form.setMandatory('cmdb_ci', false);

        g_form.setReadOnly('cmdb_ci', true);