Error: Access to this content denied based on report_view ACLs

[JayAdmin_16]

Hi there, I'll mention firstly that I'm still very green to ServiceNow administration, so gentle guidance will be appreciated. 

I’m facing a problem with 2 reports in ServiceNow that display data in a bar chart format.

One report is grouped by Producer-Category-Parent and stacked by Producer-Category with table sc_item_produced_record. The other, grouped by Item-Category-Parent and stacked by Item Category with table sc_req_item. The issue is that certain user(s) cannot see the report in their dashboard. The only way I’ve been able to grant access to the report is by assigning catalog_admin permissions, but this feels like over-allocating access to the user, including it’s child role(s) that are inherited.

We’ve discovered that the issue occurs, and the user can no longer see the report when the reports are stacked by the item/producer-category field. We’ve checked that the user has correct ACL’s to the report_view and read on the sc_category table to other roles the user currently has (that including ITIL and sn_request_read). We’ve ran this user specifically through access analyser and all the permissions look to be correct. I've seen a few other posts which I've dabbled in and tried, but I still can't find a solution that's worked. 

Let me know if any further information is required, and thanks in advance.  

[Mark Manders]

A user needs to be able to follow the entire trail of any filtering/grouping done, so you need to have read/report view rights on everything (producer, category, parent, sc_item_produced_record). If you don't have read rights to only one of the fields/tables used to create a report, you aren't allowed to see the report at all.

[JayAdmin_16]

Hey Mark, thank you for your reply. Just to make sure I understand correctly (I'm still quite new to ACL's), I have given the read/report_view to the itil role (which the user has) on the following tables below in my ACL. As the operations end with .* that would consequently provide rights on the tables listed below, as well as their fields. Is this how you would provide access to all tables and their fields? Or is there a better way to perform this action?  

sc_category.*	read
sc_category.*	report_view
sc_item_produced_record.*	read
sc_item_produced_record.*	report_view
sc_req_item.*	report_view
sc_req_item.*	read

[Mark Manders · Accepted solution]

This grants them access to the fields, but if you have ACLs that are specifically set to fields themselves, you also need to add those. If ITIL can read sc_req_item.* but you need ITIL_admin to read sc_req_item.category, you are still not able to see the data.

[Ankur Bawiskar]

@JayAdmin_16 

I agree with Mark here.

Please share the report configuration screenshot.

With that user did you try to navigate to table.LIST and see if data can be seen

If my response helped please mark it correct and close the thread so that it benefits future readers.