ACL - Arghhh. Make all fields read only, except for 2

[Josh80]

Hello

I've done a lot with ACLs but for some reason having difficulty with what I would think should be a simple thing.

LOCATIONS (cmn_location table)

I want to:

Disallow write access to all fields except for 2 fields (Contact and a custom 'comments' field).

ITIL can basically read locations, but only an onboarding groups should be able to modify 'contact' and 'comments'.

For 'write' there's a 'cmn_locaton.*'   that has no role attached; and cmn_location.u_comments and cmn_location.contact with the proper user role to allow them to edit.   With this in place, the write is blocked by an out of box ACL. */write/record

If I use cmn_location/none with a specific role (admin only), all fields are still locked.

If I use cmn_location/none with Admin role AND cmn_location.*, all fields are still locked.

*

write

record

true

cmn_location.*	write	record	true	glide.maint		2016-12-14 11:25:39
Select record for action	Preview	cmn_location.u_comments	write	record	true			016-12-14 11:17:13
Select record for action	Preview	cmn_location.contact	write	record	true			2016-12-14 10:51:18
Select record for action	Preview	cmn_location.*	read	record	true			2016-06-02 13:16:44

[randrews]

check your table acl... you have to grant them write access to the table <no field name selected> for your write access to work...

then create a filed.* on the table so only admins can write.. and then it should work..

[Josh80]

Hi - thanks for the response.

So I thought I tried that.

Do I need the first 2 rules? If would I leave role(s) blank? Admin can

override by checking the box...but there's no need to write to existing

except through nightly load; no users should manually add locations.

WRITE: cmn_location.*

WRITE: cmn_location.none

WRITE: cmn_location.comments (onboarding role)

WRITE: cmn_location.contact (onboarding role)

On Wed, Dec 14, 2016 at 12:42 PM, randrews <

[randrews]

you need a write on cmn location.       that allows your roles to write....

then you need a write on cmn.location.* with an admin role <this removes write access to ALL fields except for admins

now you need a write on the two fields you want them to write to with their roles...

acl logic...

to write to a field you need permissions at the table level AND at the field level BOTH <but you only need ONE write acl at each of the two levels table and field>

so if you have three table level acl's   cmn.location.       and you get write access on ONE of those acl's you can write to the table...

if you have five acls on the fields and one or more allows write access to that field ... you can write to the field.

if you can write to the TABLE and the Field you can edit it... i think y our problem was you needed to create a cmn.location.   acl to allow write to the table itself.

[Josh80]

Ok..it's clear again.

Thank you for taking the time.

On Dec 14, 2016 1:14 PM, "randrews" <community-no-reply@servicenow.com>