Forced encryption on attachments

Kim Sullivan
Tera Guru
 

Since upgrade to Utah, all our attachments are being encrypted.  In Tokyo and before there was a checkbox here to choose to encrypt.  That is now gone and none is not the default option.

ServiceNow support says this is OOB, but I can't believe this was intended. 

2023-07-20_8-49-50.png

#encryption

#crypto

#attachments

1 ACCEPTED SOLUTION

Kim Sullivan
Tera Guru

HI told me to post on community and this was an OOB setting.  I spent another 3 hours on it and figured this out -- 

update the optional_attachment_encrypt UI macro.

OOB config:

OOB.png

 

Updated: 

Updated.png

 

You also need to comment out these lines:

KimSullivan_0-1690491092953.png

 

View solution in original post

31 REPLIES 31

@Kim Sullivan attaching UI Macros for you reference.

<?xml version="1.0" encoding="utf-8" ?>
<j:jelly trim="false" xmlns:j="jelly:core" xmlns:g="glide" xmlns:j2="null" xmlns:g2="null">
    <div style="display:inline;" aria-hidden="true">
        <j:set var="jvar_target_table" value="${RP.getWindowProperties().get('target_table')}" />
        <g:evaluate var="jvar_encryption_modules" object="true" jelly="true">
            var encryption_modules = gs.getSession().getCryptoModulePickerForTableWithSingleModule(jelly.jvar_target_table).getSysIds();
            var encryption_modules_count = encryption_modules.size();
            encryption_modules;
        </g:evaluate>
        <g:evaluate var="jvar_encryption_modules_count">
            encryption_modules_count
        </g:evaluate>
        <g:evaluate var="jvar_current_encryption" jelly="true">
            gs.getSession().getCryptoModulePickerForTableWithSingleModule(jelly.jvar_target_table).getCurrent();
        </g:evaluate>
        <g:evaluate var="jvar_change_encryption_label">
            gs.getMessage('Change Encryption Module');
        </g:evaluate>
        <!-- Show encrypt selector as it doesn't make sense to have encrypt on some tables. -->
        <g:evaluate var="jvar_show_encrypt" jelly="true">
            var show_encrypt = jelly.jvar_encryption_modules_count > 0;
            if (jelly.jvar_target_table == 'sys_email')
            show_encrypt = false;
            show_encrypt;
        </g:evaluate>
    </div>
    <j:if test="${jvar_show_encrypt}">
        <!-- NOTE: jvar_encryption_module_count > 0 -->

        <g:evaluate var="jvar_encryption_choices" object="true" jelly="true">
            gs.getSession().getCryptoModulePickerForTableWithSingleModule(jelly.jvar_target_table).getChoices().getSelected();
        </g:evaluate>
        <!-- <g:evaluate var="jvar_current_encryption_module" jelly="true">
            gs.getSession().getCryptoModulePickerForTableWithSingleModule(jelly.jvar_target_table).getCurrent();
        </g:evaluate> -->

        <div style="margin-top: 20px;">
            <input value="${jvar_current_encryption}" id="default_encryption_module" name="default_encryption_module" type="hidden" />
            <span>
                ${gs.getMessage('Encrypt with Module')}:
            </span>
            <select id="encryption_module" title="${gs.getMessage('Encryption Module')}" onchange="actionOK(event)">
                <option value="none">${gs.getMessage('None')}</option>
                <g:options choiceList="$[jvar_encryption_choices]" choiceValue="" />
            </select>
        </div>


        <script>
            function encryptionSelected(newModule, newLabel) {
                gel("default_encryption_module").value = newModule;
                gel("sysparm_encryption_context").value = newModule;
                updateEncryptionChoice(newModule);
            }

            function updateEncryptionChoice(value) {
                rememberEncryption(value);
            }

            function rememberEncryption(value) {
                setPreference('encryption_module', value);
            }

            function actionOK(e) {
                var moduleSelect = e.target;
                var selectedValue = moduleSelect.options[moduleSelect.selectedIndex].value;
                if (selectedValue == "")
                    return false; // you must choose one if you click OK
                var selectedLabel = moduleSelect.options[moduleSelect.selectedIndex].innerHTML;
                encryptionSelected(selectedValue, selectedLabel);
                return true;
            }

            // Set the default value on load.
            gel("default_encryption_module").value = "$[jvar_current_encryption_module]";
            gel("sysparm_encryption_context").value = "$[jvar_current_encryption_module]";
            updateEncryptionChoice("$[jvar_current_encryption_module]");
        </script>
    </j:if>
</j:jelly>

Your script looks good.  Did you also check your glide.attachment.encrypt_by_default is set to false as recommended by @Jeff Boltz1 ?

 

The property glide.attachment.encrypt_by_default doesn't exist in the system, and when I attempted to create it, I received an error stating: "Not allowing set of unsafe property value: glide.attachment.encrypt_by_default=false."

I think others have struggled with that as well.  I would suggest opening a HI ticket and seeing if they can assist-- I do believe others in this thread were successful with that method.

Todd Preece
ServiceNow Employee
ServiceNow Employee

Took me some time to investigate this but at least in the context of Column Level Encryption (CLE), the option to encrypt or not is controlled by a system property 'com.glide.encryption.enable_attachment_key_ui'. True=Give the option, False=Encrypt by default. I tested this out on a Utah instance and seems to toggle the choice as expected.