how can we check if the impersonating user is part of certain group if not then deny access via ACL

[AarthyJ96944101]

We have a use case where we are checking if the user is impersonating, if yes then we need to check the user is a part of certain group or not. if no, then deny access in ACL. we have written a code as follows, but as per servicenow health scan findings we cannot use GlideRecord/GlideRecordSecure/GlideAggregate in ACL script because of performance issue. Is there any alternative way to do this?

if (GlideImpersonate().isImpersonating()) {

        //If impersonating, then check if the logged in user has access to EE Mobile domain or not

        var currentUser = gs.getImpersonatingUserID();

        var chkUser = new GlideRecordSecure('sys_user_grmember');

        chkUser.addEncodedQuery('group=46318bbffb33629019e0f860beefdc7f^user=' + currentUser);  // 46318bbffb33629019e0f860beefdc7f - Network EE Mobile Domain group

        chkUser.query();

        if (chkUser.hasNext()) {

            answer = true;

        }      

} else if (gs.getUser().isMemberOf('46318bbffb33629019e0f860beefdc7f')) {

    //If not impersonating then check if logged in user has access to EE Mobile domain

    answer = true;

    // 46318bbffb33629019e0f860beefdc7f - Network EE Mobile Domain group

} else {

    answer = false;

}

[yashkamde]

Hello @AarthyJ96944101 ,

If calling from scoped app then you can instantiate a GlideUser object for that specific sys_id:

try this :

(function() {
    var GROUP_SYS_ID = '46318bbffb33629019e0f860beefdc7f'; // Network EE Mobile Domain group

    if (GlideImpersonate().isImpersonating()) {
        // Check the REAL user (the one impersonating), not the impersonated session user
        var realUserId = gs.getImpersonatingUserID();

        var gu = new GlideUser(); // global.GlideUser if calling from a scoped app
        gu.setUserId(realUserId);

        answer = gu.isMemberOf(GROUP_SYS_ID);
    } else if (gs.getUser().isMemberOf(GROUP_SYS_ID)) {
        answer = true;
    } else {
        answer = false;
    }
})();

If my response helped mark as helpful and accept the solution.

[AarthyJ96944101]

This is not working. if the impersonting user have access or not, both the cases its giving false as the output.