Restrict a select box choice to specific group on catalog

[Joshuu]

Hi All,

I have a catalog form and a select box with 3 choices in it. Example: A,B,C.

Only 3 particular group members should be able access 'A' choice. If any user try to select from the drop down it should clear that value with an alert or that choice itself should not be visible to any other user apart from those 3 groups.

And we do not have any variable as assignment group on form. It should check the requester/user's group.

Please assist.

Thanks & Regards.

[Brad Bowman · Accepted solution]

It's a much better user experience to remove the choice rather than allow it to be selected, but then present an error in some cases.  You can do this with an onLoad Catalog Client Script which uses GlideAjax to call a Script Include

function onLoad() {
    var ga= new GlideAjax("CatalogUtils"); //Script Include name
    ga.addParam("sysparm_name", "getGroupMembership"); //name of function
    ga.addParam("sysparm_user", g_user.userID);
    ga.getXML(processResponse);

    function processResponse(response){
        var answer = response.responseXML.documentElement.getAttribute("answer");
        if (answer == 'false'){ //current user is not a member of one of the 3 groups
            g_form.removeOption("var_name","choice_value"); //replace with your variable name and choice value to be removed
        }
    }		
}

Your Client callable Script Include would look something like this:

var CatalogUtils = Class.create();
CatalogUtils.prototype = Object.extendsObject(AbstractAjaxProcessor, {
		
	getGroupMembership: function(){
		var answer = 'false';
		var usr = this.getParameter("sysparm_user");
		
		if (gs.getUser(usr).isMemberOf('group name 1')) { //replace with your group name
			answer = 'true';
		} else if (gs.getUser(usr).isMemberOf('group name 2')) { //replace with your group name
			answer = 'true';
		} else if (gs.getUser(usr).isMemberOf('group name 3')) { //replace with your group name
			answer = 'true';
		}
		
		return answer;
	},
		
    type: 'CatalogUtils'
});

[Joshuu]

Hi @Brad Bowman  ,

Thanks for your response.

It is working as expected. But, now they want to check the user from the requested_for's field on the catalog form. Requested for is a variable on the catalog form. I have tried to modify the client script as below, but not working.

function onChange(control, oldValue, newValue, isLoading) {
    if (isLoading || newValue == '') {
        return;
    }
    var access = g_form.getValue('access_role'); 
    var ga = new GlideAjax("getUserGroup"); 
    ga.addParam("sysparm_name", "getgrp"); 
    ga.addParam("sysparm_user", g_form.getValue('requestor'));
    ga.getXML(processResponse);

    function processResponse(response) {
        var answer = response.responseXML.documentElement.getAttribute("answer");
        if (answer == 'false') { 
                alert('You cannot request for Administrator Role');
                g_form.clearValue("access_role", true); 
            }
        }
    }

Please suggest.

Thank you.

[Brad Bowman]

If the only thing you changed from the working scripts is the sysparm_user line, is this script running onChange of the Requested for variable?  If so, you can use

ga.addParam("sysparm_user", newValue);

If this script is running onChange of a different variable, make sure 'requestor' is exactly the name (space- and case-sensitive) of the Requested for variable.

[Joshuu]

Hi @Brad Bowman ,

Here, we are writing on change on Access role field only.

But the issue is in case if user adds Requested for who is not part of those groups and then select admin as access role, it should clear the value of access role.

And if user changes requested for again even after adding the access role as admin, if that user is not part of the group in that case also it should clear the value of access role.

Below is the catalog form. I have written below scripts, it is not working properly. It is still taking logged in user name instead of requested_for.

function onChange(control, oldValue, newValue, isLoading) {
    if (isLoading || newValue == '') {
        return;
    }
    var access = g_form.getValue('access_role');

    var ga = new GlideAjax("getUserGroup"); //script include name
    ga.addParam("sysparm_name", "getgrp"); // script include function name
    ga.addParam("sysparm_user", g_form.getValue('requestor'));
    ga.getXML(processResponse);

    function processResponse(response) {
        var answer = response.responseXML.documentElement.getAttribute("answer");
        if (access == 'admin') {
            if (answer == 'false') { //if user is not part of the 2 groups
                alert('You cannot request for Administrator Role');
                g_form.clearValue("access_role", true);
            }
        }
    }
}

var getUserGroup = Class.create();
getUserGroup.prototype = Object.extendsObject(AbstractAjaxProcessor, {
    getgrp: function() {
        var answer = 'false';
        var usr = this.getParameter("sysparm_user");
 
        if (gs.getUser(usr).isMemberOf('IAM Tools')) {
            answer = 'true';
        } else if (gs.getUser(usr).isMemberOf('Enterprise Password Vault Support')) {
            answer = 'true';
        }
        return answer;
    },
    type: 'getUserGroup'
});

Please suggest.