How to configure ACLs so users can see tickets created by other users in Service Portal?

[patricklatella]

Hi all,

I'm working on a customer service portal, and in the portal I need to allow non-roled users to see a widget called "My company's incidents", and then for them to be able to see all the records on the incident table that have the "company" field set to their company, regardless of who created it.  Is this possible?  The query I have on the widget is correct, but when impersonating users I cannot see the records created by other users.  Anyone know how to do this?

[patricklatella]

Hi Paul, sorry one more question...so are you saying it's against the intent to have a Service Portal that is external facing at all?  Meaning just by having people enter our system and visit a dedicated Customer Service Portal who aren't in our organization could be a violation?  Or just this idea of having these external users be able to see all the tickets created by members from their external organization?  Thanks again.

[The SN Nerd]

You can use Service Portal to be externally facing, it is just supposed to be used to only view tickets that the end user has raised, not all tickets for their company.

Viewing tickets on that scale is supposed to be done in the fulfiller interface as a licensed user.

[DScroggins]

Providing view only access to incidents does not violate the fulfiller license. This was verified with SN before we took this approach. Users who do not have any ITIL role can view any incident, create their own incidents, or comment on incidents which they raised. If users do any other updates to incidents with which they were not the caller/ opener then they need a license. Portals do not have to be externally facing only. They can be created to serve any purpose your organization requires. Also to do what is asked you cannot simply use ACLS as the before query will prevent the records from being retrieved from the database in the first place. As a side note we have done this with over a 250k+ user base and 1m+ incidents with no ill side effects or unexpected outcomes.

[DScroggins]

I will agree though if there is ever a question about licensing restrictions etc it's best just to verify with your account manager. Always good to CYA.

[The SN Nerd]

Yeah, it definitely doesn't violate fulfiller, but may violate the intent of a requestor (just in case this impacts un-roled users). It's always good to check as situations can differ.

For example, we wanted to provide view-only access to an entire ITIL table from a CreateNow license and were told we weren't allowed to do that. If an unroled user can, surely a CreateNow user should be able to - but we were told it violated the intent, and the CreateNow user would have to be ITIL licensed too.
That was years ago though - if we asked the question now, maybe we would get a different answer.