glide.processors.check_access_before_process Property for Dashboards

[KapilG931162839]

Hi,

I am currently working on dashboards and have set the system property glide.processors.check_access_before_process to true (i.e., ACL check is enabled). I now need to test the behaviour of this property to ensure it's functioning as expected.

As per the documentation, when this property is set to true, the system should enforce ACL checks during dashboard creation and deletion. When set to false, these ACL checks should be bypassed.

the existing Out-of-the-Box (OOB) ACLs allow dashboard creation only if the user has the dashboard_admin or pa_admin role, and the property com.glide.par.unified_analytics.enabled is set to true (which I have already configured).

To test this, I’ve performed the following:

• Verified that the ACLs are in place and restrict creation based on roles.

• Logged in as two users:

  • One with the dashboard_admin role

  • One without the dashboard_admin role

However, both users are able to create dashboards via Self-Service > Dashboards > Create New Dashboard.

This behavior seems to indicate that the property may not be enforcing the ACLs as expected.

Could you please advise on how to properly test the glide.processors.check_access_before_process property or if there are any additional configurations required to make it work? 

Best regards,
Kapil

[Mark Manders]

What kind of dashboards are you creating? PAE dashboards or 'classic' dashboards? 

Also: do you have any other ACLs related to dashboards? That you have the ones that allow doesn't mean that there aren't any others in place. 

The property checks for access to 'sys_dashboard'. That's the dashboard layout of classic dashboards. Dashboards themselves are on the 'pa_dashboard' table (or the PAE variant of it).

[KapilG931162839]

ok to clarify

1. there are no specific ACLs on sys_dashboards,the ACLs i mentioned is in pa_dashboard table.

2.if that works for sys_dashboards how to check if this property is working or not.

if i go to dashboards through application navigator it always lands me to pa_dashboards.

can you please help how should i test the functionality of this property.

[Mithun]

@KapilG931162839 Looks like some of these documentations provided by ServiceNow is not clear. 1st of all, we do not see any table called sys_dashboards. And sys_dashboard table contains Dashboard Layouts and a very limited number of records. Below is the answer I received from ServiceNow support.

This Glide Property only affects the Dashboard processor, which is used to create or delete dashboards via the `sys_dashboard` table. Configuring this property as recommended will ensure that only authorised users can create/delete dashboards via this specific processor. As part of the Zurich release, this property will default to a value of "true".

[KapilG931162839]

Hi @Mithun  , 

Thanks for responding. But can you help me out how exactly we should test this property functionality.