Reference Qual Filter not working for non-admin users querying custom table

[Liam Rhodes1]

Hey all,

On one of our catalog items, I have a list collector variable that uses the follow reference qual filter which uses a script include to only display records in the u_sjp_partner_practices table where the user selected from the user variable is associated to. 

javascript:new PracticeFilter().getPracticeFilter(current.variables.user);

This executes the following Script Include which is client callable called PracticeFilter:

var PracticeFilter = Class.create();
PracticeFilter.prototype = {
    getPracticeFilter: function(userSysId) {
        var ids = [];
        var filter = 'sys_idIN';

        gs.info('[PracticeFilter] Called with userSysId: ' + userSysId);

        if (!userSysId) {
            gs.warn('[PracticeFilter] No userSysId provided, returning sys_idISEMPTY');
            return 'sys_idISEMPTY';
        }

        var assocGR = new GlideRecord('u_sjp_pss_firm_association');
        assocGR.addQuery('u_user', userSysId);
        assocGR.query();

        gs.info('[PracticeFilter] Found ' + assocGR.getRowCount() + ' association records for user: ' + userSysId);

        while (assocGR.next()) {
            if (assocGR.u_pss_practice_name)
                ids.push(assocGR.u_pss_practice_name.sys_id.toString());
        }

        if (ids.length === 0) {
            gs.warn('[PracticeFilter] No practices found for user: ' + userSysId);
            return 'sys_idISEMPTY';
        }

        filter += ids.join(',');
        gs.info('[PracticeFilter] Returning filter: ' + filter);
        return filter;
    },

    type: 'PracticeFilter'
};

So what this script does is it queries another custom table that we have created called 

u_sjp_pss_firm_association and searched against the u_user field (reference to sys_user) for any records where the user we've passed through matches. What it then does is return all records from the u_sjp_partner_practices table using that reference field to do so.

So the records on the u_sjp_pss_firm_association all look like this:

So it queries all records where the User field is a match and returns all records via the PSS Practice Name field.

These two custom tables have basic read/write/create/delete ACL's using a custom role which is assigned the user I'm testing with. For me, as an admin, this works perfectly fine (see below) but for a non-admin they're having no results returned:

I have checked the test users access to the table and to the records using Access Analyzer and it comes back as a pass on all ACL's. So I'm at a bit of a loss here, is this just messy ACL's or is there something else that I need to ensure has been set up to allow them to run this query?

Thanks in advance for any assistance!

[Liam Rhodes1 · Accepted solution]

Thanks all, you all got me on the right path that eventually lead me to this ServiceNow KB that resolved the issue for me. 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2283949

[Ankur Bawiskar]

@Liam Rhodes1 

any update to my above comment?