Restrict visibility of a specific Catalog Item's RITM and SCTASK to only two groups

[Ramsha Shaikh]

Title:

Restrict visibility of a specific Catalog Item's RITM and SCTASK to only two groups

Description:

Hi everyone,

I'm working on a requirement where only the RITMs and SCTASKs created from a specific Catalog Item (Language Services) should be visible to users who belong to either of these groups:

Language Services

Translation Services

All other users, including users with the itil role, should not be able to view these RITMs or SCTASKs.

What I've done so far

Created a custom role and assigned it to the Language Services and Translation Services groups.

Created a custom Read ACL.

Modified the relevant OOB Read ACLs on the sc_req_item table by adding a condition to prevent access to this specific catalog item.

The ACLs modified include:

• sc_req_item

• sc_req_item.list

• Record-level (--None--) Read ACLs

Issue

Despite these changes, users who only have the itil role (and are not members of the Language Services or Translation Services groups) are still able to:

View the RITM in the list.

Open the RITM form.

Access the full record.

They are not receiving any security constraint or ACL error.

Additional Information

Table: sc_req_item

The users have the itil role.

The requirement applies only to one specific Catalog Item.

I will also need to apply the same restriction to the corresponding sc_task records.

My Question

Is there another OOB ACL (possibly inherited from the Task table) or another mechanism that's granting access to sc_req_item records despite my custom ACLs?

Has anyone implemented record-level security for a specific catalog item's RITMs and SCTASKs? If so, what is the recommended approach?

Any guidance would be greatly appreciated.

Thank you!

[Lakshmi888888]

I would recommend enabling Debug Security Rules and testing with an affected ITIL user. This will show exactly which ACL is granting access.

Also check Read ACLs on:

• task
• task.*
• task.none
• sc_req_item
• sc_task

Since sc_req_item extends the Task table, access may be coming from a Task-level ACL rather than your custom RITM ACL.

For this requirement, a scripted Read ACL on sc_req_item and sc_task that checks the Catalog Item and allows access only to members of the Language Services and Translation Services groups is typically the recommended approach.

[Lakshmi888888]

I would recommend enabling Debug Security Rules and testing with an affected ITIL user. This will show exactly which ACL is granting access.

Also check Read ACLs on:

task
task.*
task.none
sc_req_item
sc_task
Since sc_req_item extends the Task table, access may be coming from a Task-level ACL rather than your custom RITM ACL.

For this requirement, a scripted Read ACL on sc_req_item and sc_task that checks the Catalog Item and allows access only to members of the Language Services and Translation Services groups is typically the recommended approach.

[OlaN]

Hi,

There might be many different ACL that will grant access to the record, and once granted it does not evaluate other records that would be more restrictive in access.

My best tip would be to use the Access Analyzer tool (built in, no install needed) to evaluate the access and help you investigate which ACL granted the access.

[Shruti]

Hi @Ramsha Shaikh 

Create a table-level Read ACL on the sc_req_item table. Set the Decision Type to Deny Unless. Add a condition for the specific catalog item, and include a script that verifies whether the user is a member of the Language Services or Translation Services group.