How to create read only ACL for custom table?

[evogel]

Hello!

How to create read only ACL for custom table? This worked in the dev, but not the test instance.

To be specific:

• A catalog request uses a variable that references this table.
• The catalog request is open to any SN user that can log in.
• All values in the table should be accessible with ready-only permission to any user. Just a long list of available systems.
• Only admins should create or modify.
• Catalog item variable works in the dev instance, but not our test instance?

Steps taken:

• Using elevated role security_admin.
• Recreated the ACL on test.
• Checked "Create access controls" and used 'user.'
• Removed "user" role from the ACL with read operation.
• Added an ACL record to read all table contents, and removed user role requirement from below.

This thread is closely related, but no resolution there either.

Same setup for Dev and Test

ACL execution in Dev:

ACL execution in Test:

The additional ACL record created to just read, without role required.

End result in Test. Dev shows all the choices while impersonating the same user (who has no roles assigned).

What am I missing here?

[krr]

In case it's the same issue, this week I promoted an application from dev to prod and none of the ACLs restricted access in prod where they did in dev. Even ESS users with no role could read and edit.

I was testing via impersonation.

After an hour of pulling my hair out, I opened a Chrome Incognito window to test as a new session and logged in as my admin account. Impersonating another user then did properly restrict their access.

It appeared to mix my admin access in with the user I was impersonating in the non-incognito window.

Not sure if is the same thing I ran in to, but sounds similar.

[evogel]

No fix. Tried logging in with dedicated Test User that has no roles assigned, on a different browser. Same effect.

[kartik8]

Hi Edward,

For The additional ACL record created to just read, without role required part can you create table.none acl instead of table.*?

[evogel]

No fix. Tried this and the list collector still shows no matches for results.