Preview Record of a Reference Field Allows Users to Edit Their Records Through Catalog Form

[Irene M]

Hi everyone!

I need help figuring out how to fix this issue.

We just discovered that users (both ITIL and non-ITIL) can update their own records by clicking the "i" icon beside a field in the catalog form. This field is a reference field that points to the sys_user table.

Our requirements are:
        1. Non-ITIL users should not be able to update their records. All fields must be read-only.
        2. ITIL users should only be able to update their mobile phone number. All other fields must be read-only.

How can we achieve this? I appreciate any suggestions or guidance. Thanks in advance!

[Kieran3]

Hi @Irene M 

You'll need to do this via ACLs, not on the catalog item level as the reference pop-up is a view to that table so ACLs control it instead.

It will need security admin to make ACLs so if you don't have this, contact a system administrator.

If this doesn't help, let me know and we can keep discussing!

If this has helped resolve your issue, be sure to mark it as the correct answer to help anyone else with a similar issue 🙂

[Irene M]

Hi @Kieran3,

Thank you for responding to my post.

I created a write ACL on the sys_user table. It's working for non-ITIL users—they can no longer write to the table, and all fields are now disabled for them.

However, ITIL users also can't write to the table. We need ITIL users to be able to update only the Mobile Phone field, while all other fields should remain read-only.

How can I achieve this?

[Kieran3]

Hi @Irene 

So you'll need: 

• Table ACL (sys_user) - Allowing ITIL users to write
• Field ACL (sys_user.mobile_phone) - Allowing ITIL users to write
• Field ACL (sys_user.*) - Deny write access to all other fields

The user will then first pass the table write ACL to edit 'sys_user' record and then pass the field-level write ACL for every field. The specific 'sys_user.mobile_phone' ACL will be evaluated before the broader 'sys_user.*', so Mobile Phone stays editable whilst the other fields become read only

[Irene M]

Hi @Kieran3 thanks for responding. Something we forgot to consider is that we have an automation from ActiveDirectory that writes user information in our sys_user table. When I did this, it blocks ActiveDirectory leaving newly created user with empty information such as Name, titlr, email, etc. basically all the fields that we deny write access.