Refresh user's Roles without logging out

[Andrew Albury-D]

Hey everyone,

I'm looking at building an "Elevate to Admin" tool which will let our developers have a single account, without being granted Admin until they need it in Production. I've found some mentions online for a "GlideSecurityManager" API which is "undocumented" but in theory, should do what I need. (found here: https://snprotips.com/undocumented-servicenow-apis)

I am creating a "sys_user_has_role" record for a user, with the role of Admin, and would love to let them not have to log out and back in to apply these changes.

Does anyone know exactly how to use the GlideSecurityManager API? I've tried a few ways - Background script, BR on sys_user_has_role, Flow Designer Action, and none seem to work. e.g.

Any help is appreciated,

Thanks,
Andrew

[Pranesh072]

i also checked few articles, maybe setUser method isnt working as it is undocumented method .

https://community.servicenow.com/community?id=community_question&sys_id=2cb18fba1bf24058fff162c4bd4b...

https://community.servicenow.com/community?id=community_question&sys_id=9155ae2bdb06ab802e8c2183ca96...

[Andrew Albury-D]

Hey Pranesh,

Thanks for the links. I might do some troubleshooting like the logging in the first post, but you are right - it seems to maybe have stopped working. 

I'll keep digging. Thanks!

[Mark Roethof]

Ha Andrew,

This sounds interesting! Had a use case for something similar a while ago though didn't come up with a proper solution. This API - if working - sounds like a nice way to go.

When performing a quick code search using SNUtils I do see several out-the-box scripts using GlideSecurityManager. Maybe there's a lead there? I'll have a look also later today.

Kind regards,
Mark

[Aishwarya Theva]

Hi Andrew,

That sounds interesting!!

GlideSecurityManager.get().setUser(userObject)

Where the user object is a user object that you get using gs.getUser().getUserByID('user_name_or_sys_id').

Please log and see if you getting the correct values in line number 5, it would be great if you can share some more details about the business rule.

If that doesn't work then I guess it would be the session that might be still active, you would need to invalidate the user session.

Try this out

Please refer this post to see on how it can be done :

https://community.servicenow.com/community?id=community_question&sys_id=725587addbd8dbc01dcaf3231f9619ac

Addition link where Tomas tried to do something similar :

https://community.servicenow.com/community?id=community_question&sys_id=9155ae2bdb06ab802e8c2183ca96197f

Please let me know if this works!

Thanks

Aishwarya Thevar