Regarding the ACL for reading restricted records

[Gintarelissss98]

I have a requirement to restrict access to a certain type of problem and allow only specific groups to read them, table: problem, type: read. Therefore, I need an ACL on the Problem table with a script. However, this should apply to all created roles as only members of these groups should have the ability to see these records. Currently, it only works if a user has the 'itil' role. For example, a user with the 'sn_problem_read' role can see everything, even if they are not a member of that group.

How can I solve this issue? Do I need to add all roles that have read access to problems to the newly created ACL? I tried doing that, but it didn't work. Users with other roles can still see everything.

[Dr Atul G- LNG]

Hi @Gintarelissss98 

Share code please to chekc.

[Gintarelissss98]

Hello, this is my script include that I call in the ACL table 'problem' with the operation 'read'. It works perfectly if the user has the ITIL role, is added to the support group, or removed from it. However, if the user is assigned to the 'sn_problem_read' role or any other role, regardless of their role, they can see all the records.

var checkIfRelatedToIncident = Class.create();

checkIfRelatedToIncident.prototype = {

    initialize: function() {},

    checkSecurityProblem: function(current) {

        var flag = false;

        var securityMember = false;

        var prob = current.sys_id;

        if (gs.getUser().isMemberOf(gs.getProperty('group.it.sec')) || gs.getUser().isMemberOf(gs.getProperty('group.help.desk'))) {

            securityMember = true;

        }

        var incidentGR = new GlideRecord('incident');

        incidentGR.addQuery('problem_id', prob);

        incidentGR.addQuery('u_security_incident', true);

        incidentGR.setLimit(1);

        incidentGR.query();

        if (incidentGR.hasNext()) {

            if (securityMember) {

                flag = true;

            } else {

                flag = false;

            }

        } else {

            flag = true;

        }

    return flag;

    },

    type: 'checkIfRelatedToIncident'

};