Is there an ACL or system property that allows external users to put attachments to catalog items?

[CatchTheFletch]

I found what I thought would be the answer in the system properties -> security page but after adding snc_external I'm still having issues. The only other role under "List of roles that can create attachments" is public. Any kind of direction on this would be appreciated. Right now when an external user attempts to attach something to submit a form it pulls up their computer browse option but then doesn't actually attach any file when selected.

[Tony Chatfield1]

Hi, I would not expect there to be any OOB constraints that would prevent an snc_external user from adding attachments via a catalog item\record producer and unfortunately the issue is not clear based on your description.
Is it that the user adds the file\attachment, but it is not saved - have you checked sys_attachment table?
Or that the user adds the attachment (it is visible in sys_attachment table after upload) but the attachment is not copied to the task that is created from the record producer when it is submitted?

Have you enabled security debug, impersonated a snc-external user reproduced the issue and checked your debug logs to see if a ACL is the cause?

ACL debugging tools (servicenow.com)

[CatchTheFletch]

Hey Tony,

Thanks for the response. The user will click Add Attachment, file explorer opens up so they can select a file, and once a file is selected it does not attach. Only external users are having this issue. As an example I can use any other user with ITIL and attach without issue. I have not done that level of debugging but can certainly look into it.

[Tony Chatfield1]

Did you check to see if the file was being added to sys_attachment table?

If there is an ACL preventing creation of a record in sys_attachment then I would think it was the result of local customization.

This appears to be the OOB create ACL
/sys_security_acl.do?sys_id=2c089d948f13210009ec4b8cb6e79ab8&sysparm_record_target=sys_security_acl&sysparm_record_row=29&sysparm_record_rows=47&sysparm_record_list=name%3D*%5EORnameSTARTSWITH*.%5EORname%3Dsys_attachment%5EORnameSTARTSWITHsys_attachment.%5EORDERBYname

[CatchTheFletch]

I can check on that. Would the file even make it to the table though if it's not showing as attached on the front end?