Restricting view of Incidents (ACL)

[jayson5]

Hello Community,

The Incident form has a lot of ACLs, However I need to lock down All HR Incidents to users with an HR Role...I've put the following in for a Read ACL, however it locks everyone out of the Incidents

if the "Functional Area" = Human Resources I want to restrict those Incidents to only users with that role

ACL Script:

current.u_functional_area = 'HUMAN RESOURCES';

Requires Role:

HR

[jayson5]

Thanks Deepak for the reply! So I'm going to the BR route since their are so many ACLs on the Incident form.

I have my Before Query business rule as follows which queries

if(!gs.hasRole('hrRelatedRole')){

current.addQuery('u_functional_area ','!=','HUMAN RESOURCES');

}

However what blocks access for users that don't have the HR role? I've never done access restriction outside of ACLs

[Deepak Ingale1]

Hi Jason,

Query Business rule is one the Business rule which queries against the "table" you have configured it on.

This rule queries the table and fetches the records based on what we define inside it.

/* Query the incident table and restrict access to records with
u_functional_area == "Human Resources" to only HR person
*/
if(!gs.hasRole('hrRelatedRole')){ // if user does not have hrRelatedRole
current.addQuery('u_functional_area ','!=','HUMAN RESOURCES');// , then bring records where functional area is not human resources
}

[jayson5]

Deepak,

I have created the Before query BR and I've logged in with a user that doesn't have the HR role, they are still able to see the HUMAN RESOURCES Incidents. I'm also using the following ACL on the Incident table.

[jayson5]

Deepak the Business Rule has seem to work! Just have to do some more testing to confirm.

Thank you for your support everyone and Deepak!

Thank you!

Jason

[Deepak Ingale1]

Hi Jason,

Great to know that it worked for you.

Kindly do not forget mark the appropriate post as helpful/correct once you are done with the testing.