script to scan ACL with empty conditions, script and roles

[harikcm]

Hello Community,

I need a background script to query the ACLs which doesn't have any condition, script or Roles.

I got my script working for Conditions and Script but roles part I'm unable to find a way.

Did anyone did this already?

[Marco0o1]

Hi @harikcm :

Use this script, I run i BG and take some time to run:

var aclGR = new GlideRecord("sys_security_acl");
aclGR.addActiveQuery();
aclGR.query();

while(aclGR.next()){

    var aclRolesGR = new GlideRecord("sys_security_acl_role");
    aclRolesGR.addQuery("sys_security_acl", aclGR.getUniqueValue());
    aclRolesGR.query();
    if(!aclRolesGR.next()){
        //This ACL dont have assigned Role
        gs.print("The ACL: " + aclGR.name + " " + aclGR.operation + " dont have role assigned")
    }

}

I can't run in my dev instance because I have the CSM plugin that fill at least 1 rol "snc_internal or snc_external" on the ACLs. But that should work for you.

Hope that help you.

[harikcm]

@Marco0o1 This gave me ACLs with script and conditions not empty. Thanks for the response.

[Harish Bainsla]

try this

var aclGR = new GlideRecord("sys_security_acl");
aclGR.addActiveQuery();
aclGR.query();

while (aclGR.next()) {
var hasRole = hasRoles(aclGR);
var hasCondition = !gs.nil(aclGR.condition);
var hasScript = !gs.nil(aclGR.script);

if (!hasRole && !hasCondition && !hasScript) {
gs.print("The ACL: " + aclGR.name + " " + aclGR.operation + " doesn't have roles, condition, or script assigned.");
}
}

function hasRoles(acl) {
var aclRolesGR = new GlideRecord("sys_security_acl_role");
aclRolesGR.addQuery("sys_security_acl", acl.getUniqueValue());
aclRolesGR.query();
return aclRolesGR.hasNext();
}

[AnveshKumar M]

Hi @harikcm 

ACL script and conditions are defined in the ACL record (sys_security_acl table) itself but the roles are defined in separate table called sys_security_acl_role. To query all 3 empty checks ACLs, you can use the following script.

var aclGr = new GlideRecord("sys_security_acl");

aclGr.addEncodedQuery("scriptISEMPTY^conditionISEMPTY"); //Script and Condition is empty

aclGr.addActiveQuery();

aclGr.query();

while(aclGr._next()){

   aclRoleGr = new GlideRecord("sys_security_acl_role");

   aclRoleGr.addQuery("sys_security_acl", aclGr.sys_id);

   aclRoleGr.query();

   if(!aclRoleGr._next()){

      gs.print(aclGr.sys_id);

   }

}

Please mark my answer helpful and accept as solution if it helped you 👍✅