question ACL not working as expected. in ITOM forum

ACL not working as expected.

Sattimsetti raj — Wed, 28 Feb 2024 14:14:51 GMT

Hi All,

I have created new field called " Support model " in hardware table (cmdb_ci_hardware) and also, I have created the new role called " u_cmdb_ci_manager " users having " u_cmdb_ci_manager " role " Support model " field should be editable.

The three main ACLs I've created are:

I'm facing some issues with these ACLs because what those ACLs have now done is made some unnecessary fields editable e.g. the Name field should not be editable.

So, I was just wondering what I'm doing wrong and what I need to do make this field editable and keep the other fields read only.

Re: ACL not working as expected.

Tony Chatfield1 — Wed, 28 Feb 2024 22:28:07 GMT

Hi,

for the role
Hardware(none) would allow write to the table.
Hardware.Support Model allows write to this specific field.

But Hardware.* is a wild card acl that allows write to all fields of the Hardware table.
I would disable this wild card ACL and see if this resolves your issue.

Re: ACL not working as expected.

Harish KM — Thu, 29 Feb 2024 01:37:39 GMT

HI @Sattimsetti raj you dont need table.* ACL as this will grant access to all fields. Deactivate this ACL

field level ACL will override tablename.* ACL which is needed in your case so field level ACL is good to go.

Re: ACL not working as expected.

Aman Kumar S — Thu, 29 Feb 2024 02:33:59 GMT

Hi @Sattimsetti raj

You need to get rid of the "cmdb_ci_hardware.*", as this ACL enables edit access for all the fields on the table.

Only keep "cmdb_ci_hardware.none" and "cmdb_ci_hardware.Support model" Write ACL.

Re: ACL not working as expected.

Sattimsetti raj — Thu, 29 Feb 2024 05:11:58 GMT

I have disabled the Hardware.* is a wild card acl :

Still, I see " Support model " field read-only and the other fields are editable:

Re: ACL not working as expected.

Sattimsetti raj — Thu, 29 Feb 2024 05:12:54 GMT

Hi,

I have disabled the Hardware.* is a wild card acl :

Still, I see " Support model " field read-only and the other fields are editable:

Re: ACL not working as expected.

Sattimsetti raj — Thu, 29 Feb 2024 05:13:35 GMT

I have disabled the Hardware.* is a wild card acl :

Still, I see " Support model " field read-only and the other fields are editable:

Re: ACL not working as expected.

Harish KM — Thu, 29 Feb 2024 05:17:06 GMT

Hi @Sattimsetti raj

First ensure your not making field readonly on dictionary level and via scripts and

As showed in screenshot, Enable debug security and click on the debugged to check which ACL is not allowing to edit the field

look for the red ones here for write ACL

Re: ACL not working as expected.

Sattimsetti raj — Thu, 29 Feb 2024 05:59:34 GMT

I see red mark is showing its created by me write role to the support group field.

Re: ACL not working as expected.

Harish KM — Thu, 29 Feb 2024 06:03:04 GMT

Hi @Sattimsetti raj what do you have in advanced script section of ACL?

Re: ACL not working as expected.

Sattimsetti raj — Thu, 29 Feb 2024 06:13:02 GMT

I don't have its blank only:

Re: ACL not working as expected.

Harish KM — Thu, 29 Feb 2024 06:16:31 GMT

Hi @Sattimsetti raj can you uncheck the advanced check box also I dont see the fieldname in ACL. can you check that and confirm also the user your testing has the role?

Re: ACL not working as expected.

Sattimsetti raj — Thu, 29 Feb 2024 06:22:27 GMT

user role was: u_cmdb_ci_manager

Re: ACL not working as expected.

Aman Kumar S — Thu, 29 Feb 2024 06:26:29 GMT

@Sattimsetti raj

Can you check by any chance if you have made the field read only on dictionary level, check Read only checkbox on the field.

Also, in the table.none write acl, you also have hardware role added there, right?

Re: ACL not working as expected.

Harish KM — Thu, 29 Feb 2024 06:28:45 GMT

Hi @Sattimsetti raj is there any scripts which is making the field readonly?

Re: ACL not working as expected.

Sattimsetti raj — Thu, 29 Feb 2024 06:32:09 GMT

Hi,

NO, its new field I have created.

Re: ACL not working as expected.

Sattimsetti raj — Thu, 29 Feb 2024 06:38:16 GMT

Hi,

Can you check by any chance if you have made the field read only on dictionary level, check Read only checkbox on the field:

Also, in the table.none write acl, you also have hardware role added there, right? : Yes.

Re: ACL not working as expected.

Harish KM — Thu, 29 Feb 2024 06:49:44 GMT

Hi @Sattimsetti raj I just tested in PDI, here is what i did,

1.created a new field "Support Mod" on cmdb_ci_hardware table

2.created a new role u_cmdb_ci_manager

3. Assigned user Fred luddy u_cmdb_ci_manager role

4. Created a Write ACL as below

Result:

1. As Fred with u_cmdb_ci_manager role. Field editable

tested as itil user, field not editable

Re: ACL not working as expected.

Sattimsetti raj — Thu, 29 Feb 2024 07:08:57 GMT

My instance is not working. anything less needs to be check?

Re: ACL not working as expected.

Harish KM — Thu, 29 Feb 2024 07:21:31 GMT

Hi @Sattimsetti raj is there any other write ACL on cmdb ci hardware table? you can deactivate this ACL and try to create new one and test just for testing purpose?