Part of the query on cmdb ci has been ignored because of insufficient access query range operations

[pradeepcm]

Hello Everyone ,

@crowe1288greg   @AndersBGS @ @nitin gupta1   @Dr Atul G- LNG   @Tanushree Maiti

@Ehab Pilloor 

@pavani_paluri 

 I'm seeing the following message  when creating a new change Request in UAT instance .

part of the query on cmdb ci has been ignored because of insufficient access for query range operation on cmdb ci attributes .

The message appears immediately when opening a new change record even before selecting a configuration item,.

I would appreciate your guidance on the above 

What typically causes this query range access message on cmdb ci attributes ?

Is this usually related to ACL data filtaration , query business rules or cmdb applications ?

Has any one encountered this after a platform upgrade or patch?

What logs or troubleshooting steps would you recommend to identify the root cause ?

Any suggestions nor similar experiences would be greatly appreciated .

Thanks and regards ,

PradeepM

[AndersBGS]

Hi @pradeepcm 

From top of mind, then this is an ACL causing this for a related table (some CMDB table accordingly you description) to the change_request where there is insufficient rights… I would look towards the ACLs for query range ACL for further investigation.

[Dr Atul G- LNG]

Hi @pradeepcm 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3115286

Resolution

1. Note the field and operation named in the error (for example, query_match on table.field example: time_card.category).
2. Run Access Analyzer (Analyze Permissions) for the affected user, table, and field to identify which ACL is blocking access. As an alternative, impersonate the user with Debug Security Rules enabled and reproduce the action.
3. Create a new query_match ACL for that table/field, or modify the existing ACL, so its roles and conditions can be satisfied by the affected user.
4. Confirm the user also has the required read access on the field where applicable.
5. Re-test as the affected user and confirm the query no longer drops the clause and the error no longer appears.

Related Links

Query ACLs (query_match and query_range) — ServiceNow Community