The Zurich release has arrived! Interested in new features and functionalities? Click here for more

Updating a record by third party user via email

sidarth
Giga Expert

Hi All,

So I have a requirement like any person irrespective of the fact whether he/she is in the system or not should be able to update the HR Case.

e.g. I click on the email icon on a HR case and send an email to abc@example.com.

              Now when abc sends back a reply it should update that HR case even if abc is not in the system or doesn't have any roles.

          Note: It is working fine when the user is in the system, has no roles but is associated with the case (he might be opened_for, opened_by)

                              In this case the email he sends gets processed and the case is getting updated.

                            But if the user is not associated with the case and doesn't have specific role the email gets errored out.

I have provided the screenshot below of the email logs.

inbound.PNG

Any help would be appreciated

1 ACCEPTED SOLUTION

sidarth
Giga Expert

This will be resolved if we deactivate the "Restrict Query" business rule


View solution in original post

12 REPLIES 12

Chuck Tomasi
Tera Patron

It appears the standard behavior is to accept the mail rather than error it out. The email properties can either create a new user account based off the unknown email (off by default) or just accept it and mark it the updates from Guest. This assumes all domains are trusted.



find_real_file.png


Reference:Email Properties - ServiceNow Wiki


I have the same Out of the box configuration


Hey Sidarth,



      Did you find the solution to this?   I am having the exact problem.   We added the Watch List field to the HR Case and thought the script include below meant that no matter who replied to the email from the HR Case, that the inbound email they sent back would update the HR Case.   Nope, we're seeing what you talk about in this thread.   The script include is called by business rule 'Restrict query".   Any help is appreciated.   I have HI support reviewing this issue also.



Per the script include, hr_CaseSecurityManager, see the code below:


// Check if it's a user in the watch list field


if (this._isInWatchList()) {


this._logDebug("[canRead] Granting access to watch list user");


return true;


}


find_real_file.png


Just deactivate the Restrict query business rule. It will work


Sidarth,



        Thank you for the feedback.   Do you have any feedback on discussions that you may have had around the security concerns of deactivating the business rule?



Shane