Domain Separation - Domain visibility list only if Top contains the domain?

david_legrand · ‎05-21-2015

I have a weird behavior on my DEVELOPER Fuji instance.

According the Domain Separation Setup - ServiceNow Wiki, I should be able to easily add a "domain contains another domain". (and it worked for me on Eureka instances if my memories are correct).

Structure:

I want to give "MSP Offshore" accesses to "Customer 1" and "Customer 4".

So I click on "edit", for the "contains domains" and I don't have any domains because the domain can't see the full hierarchy.

My workaround is:

1) On the Top domain, add "contained by" MSP Offshore (to give MSP Offshore the full access to the hierarchy)

2) On the MSP Offshore domain, go back on the "contains domains", add the necessary domains and remove the TOP domain.

But do we agree this is not how the domain separation should work on the contains domains?

david_legrand · ‎08-03-2015

I found the solution (I think) and I'm informing ServiceNow Hi support so the wiki will be updated.

We need to use the "Toggle Domain Scope" to use the domain of the admin (global normally) instead of the current domain.

I'm copying below the wiki page http://wiki.servicenow.com/index.php?title=Domain_Separation_Setup#Creating_Contains_Relationships_B... and highlighted in yellow, I'm adding the additional step

4.3 Creating Contains Relationships Between Domains

Creating a contains relationship between domains changes the domain hierarchy. Domains in a contains relationship inherit the visibility settings of the containing domain. The containing domain allows users to see data in the contained domain as well as any of its children. Processes are unaffected by a contains relationship.

Navigate to the domain table.
Select the domain record that will be the parent (container) domain of the new contains relationship.
Make a right click on the "record banner" and use the menu item "Toggle Domain Scope" (new Fuji feature)
From the Contains Domains related list, click Edit.
Select the domain records that will be the child (contained) domains of the contains relationship.
Click Save, and then click Update.
You don't need to undo the domain scope, it's undone automatically once you quit the record

View solution in original post

david_legrand · ‎05-21-2015

I tested on an Eureka instance and this is working fine on Eureka.

The Developer instance is Fuji Patch 2 Hotfix 1.

epam · ‎07-08-2015

Hi David,

There is a notice about the new Fuji enhancement on Wiki: "The domain reference pickers provide access to all domains that the user has access to, regardless of which domain the user is currently in". Maybe it is the cause of the domain separation behavior you are mentioned? And I think for the user with admin role in global domain it is obviously looks like a bug.

Deepak Ingale1 · ‎07-14-2015

Hi,

Are you talking about Domain Reference Picker UI macro?

That will anyways give access to domains user has visibility to.

The main problem is, how do we give visibility to user / group for a domain which is not in a hierarchy in case of

the example shown by David.

Deepak Ingale1 · ‎07-14-2015

Hello Sir,

Have you found solution for this.

It is the same issue with my instance as well.

We are also not able to see across domains to grant visibility / contains relationship unless we define contains relationship with parent