Locking down access to Catalog Item with ACL

[jonny27]

Hi team

I'm not great with ACLs or scripting but could do with some assistance with locking down a specific catalog item:

• I have a catalog item called 'Account Audit Request' and a workflow to have it approved
• I have created a group that should have access to it called 'Account Audit Team'

I need these requests to be heavily locked down so even the Service Desk team can't see them (or anyone with the generic ITIL access) and only visible to the 'Account Audit Team' group. 

I have two catalog tasks generated as part of the workflow to provide and revoke access, so the assignee of that task will also need access to catalog tasks only and not the RITM, and only when it is assigned to them.

Is this doable, and, if so, how do I implement it?

Many thanks

[Ankur Bawiskar · Accepted solution]

@jonny27 

rather than playing with ACLs; sometimes query Business rule are good options

Sample below

This query BR will only run if logged in user is not member of that Group so that it performs the restriction

1) if logged in user is not member of that Audit group it would hide those RITMs belonging to that catalog item

Condition:

gs.isInteractive() && !gs.getUser().isMemberOf('Account Audit Team') && !gs.hasRole('admin')

Script:

(function executeRule(current, previous /*null when async*/) {

    // Add your code here

if(!gs.getUser().isMemberOf('Account Audit Team')){

current.addEncodedQuery('cat_item.name!=Account Audit Request');

}

})(current, previous);

Regards
Ankur

[jonny27]

Hi Ankur

I've written that business rule but it's not working unfortunately. Still people who are not admins and not members of that group can see those requests and all the information in them. 

Just to tidy one thing up, the catalog item is called 'Request E-Discovery/Account Audit' so I replaced that in the script you provided.

Thank you

[Ankur Bawiskar]

Hi,

the BR should be on sc_req_item table

please share your BR condition and script

Regards
Ankur

[jonny27]

gs.isInteractive() && !gs.getUser().isMemberOf('Account Audit Team') && !gs.hasRole('admin')

(function executeRule(current, previous /*null when async*/) {

// Add your code here

if(!gs.getUser().isMemberOf('Account Audit Team')){

current.addEncodedQuery('cat_item.name!=Request E-Discovery/Account Audit');

}

})(current, previous);

[Ankur Bawiskar]

Hi,

So what happens when

1) member of that group checks RITM table

2) non-member checks RITM table

Regards
Ankur