Acl not working on scripted rest API

jobin1
Tera Expert

Hi All

 

I have created an ACL for accessing rest api and attched in security tab but its not working all users without itil role also can retrieve data from ServiceNow

how we can rectify this issue?

 

 

 

 ACL

 

 

 POSTMAN

 

 

 

 

 USER PROFILE

 

1 ACCEPTED SOLUTION

Hi jobin,

You need the ACL!
But GlideRecordSecure is evaluating the ACLs when being invoked, while GlideRecord is bypassing the ACLs!!

Try this out and let me know the results!!

Hope this helps!

Please, don't forget to mark my answer as correct if it solves your issue or mark it as helpful if it is relevant for you!

Best Regards,

Filipe Cruz

View solution in original post

5 REPLIES 5

jobin1
Tera Expert

@Filipe Cruz Any idea?

 

or can we handle in below script?

(function process( /*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
var arr = [];
var result = {};
var compsid;
var no_data = true;

var company = new GlideRecord('core_company');

company.addQuery('name', 'IN', 'Internal Tools');
company.query();
if (company.next()) {
compsid = company.sys_id;
var gr = new GlideRecord("sc_req_item");
gr.addEncodedQuery('active=true^state!=6^priority=1^ORpriority=2^company=' + compsid);
gr.query();
while (gr.next()) {
var gr2 = new GlideRecord("sc_req_item");
gr2.addQuery('number', gr.number);
gr2.query();
if (gr2.next()) {
no_data = false;
arr.push({
"Number": gr2.number,
"Short Description": gr2.short_description,
"Description": gr2.description,
"Assignment Group": gr2.assignment_group.name,
"Assigned to": gr2.assigned_to.name,
"Category": gr2.u_category.getDisplayValue(),
"Type": gr2.u_sub_category.getDisplayValue(),
"Item": gr2.u_subcategory2.getDisplayValue(),
"Requested For": gr2.request.requested_for.name,
"State": gr2.state.getDisplayValue(),
"Urgency": gr2.urgency.getDisplayValue(),
"Created On": gr2.sys_created_on,
"Created By": gr2.sys_created_by,
"Last Updated By": gr2.sys_updated_by,
"Last Updated On": gr2.sys_updated_on,
"Resolved Date": gr2.u_resolved_date,
"Resolution Category": gr2.u_resolution_category.getDisplayValue(),
"Close Notes": gr2.close_notes,
"Opened": gr2.opened_at,
"Opened by": gr2.opened_by.name,
"Priority": gr2.priority.getDisplayValue(),
"Reassignment count": gr2.reassignment_count,
"Request": gr2.request.number,
"Requestor": gr2.u_requestor.name,
"Company": gr2.company.name,
"Active": gr2.active.getDisplayValue(),
"Sys_id": gr2.sys_id,
"Reported date": gr2.u_reported_date.getDisplayValue()
});

}
result.Data = arr;

}
if (no_data)
result.Result = "No Data Found";
}


response.setBody(result);
}

 


)(request, response);

Hello jobin,

Instead of using the GlideRecord, try to use the GlideRecordSecure:

https://developer.servicenow.com/blog.do?p=/post/gliderecord-vs-gliderecordsecure/

GlideRecordSecure is similar to GlideRecord, but enforces the evaluation of ACLs, so I think that will have a positive outcome for you.

Let me know if that fixed the issue.

Please, don't forget to mark my answer as correct if it solves your issue or mark it as helpful if it is relevant for you!

Best Regards,

Filipe Cruz

So ACL is not required while using GlideRecordSecure ? here our requirement is ->if the user doesn't have Itil role then they should not able to access data.

Hi jobin,

You need the ACL!
But GlideRecordSecure is evaluating the ACLs when being invoked, while GlideRecord is bypassing the ACLs!!

Try this out and let me know the results!!

Hope this helps!

Please, don't forget to mark my answer as correct if it solves your issue or mark it as helpful if it is relevant for you!

Best Regards,

Filipe Cruz