question Re: How are Multiple ACL Rules at the Same Point in the Processing Order evaluated? in ITSM forum

How are Multiple ACL Rules at the Same Point in the Processing Order evaluated?

Heiko Bllr — Wed, 23 Jul 2014 16:38:46 GMT

Below is what is stated in the Wiki. I find it contradicting.

....

If ServiceNow matches two or more rules at the same point in the processing order, the user must pass any one of the ACL rules permissions in order to access the object. For example, if you create two field ACL rules for incident.number, then a user who passes one rule has access to the number field regardless of whether the user failed any other field ACL rule at the same point in the processing order.

...

"....the user must pass any one of the ACL...." (does any one mean ALL ?)

"....a user who passes one rule has access to the number field regardless of whether the user failed any other field ACL rule at the same point in the processing order..."

So which of the above two statements is true? Do both rules have to return TRUE or just one of them? I would assume that all rules have to return TRUE.

Thanks,

Heiko

Re: How are Multiple ACL Rules at the Same Point in the Processing Order evaluated?

acretion — Wed, 23 Jul 2014 18:28:57 GMT

Just one would need to return true if they are both incident.number field ACLs

On the other hand, If you had one incident.number field ACL and one incident table level ACL (no dot anything) then both need to be true

Re: How are Multiple ACL Rules at the Same Point in the Processing Order evaluated?

faisal_dadabhoy — Wed, 23 Jul 2014 19:20:26 GMT

I believe Christopher is right, just one ACL needs to true to grant access (but not sure)

For that ACL it will evaluate Role, Condition and Script to grant access.

Thanks, Faisal

Re: How are Multiple ACL Rules at the Same Point in the Processing Order evaluated?

Heiko Bllr — Thu, 24 Jul 2014 07:36:14 GMT

Thanks Christopher for your quick response.

Heiko

Re: How are Multiple ACL Rules at the Same Point in the Processing Order evaluated?

amol_joshi — Thu, 04 Apr 2024 00:45:25 GMT

I have 5 "table-none" READ ACLs on table sn_grc_issue. They have different roles in them but which one actually works in the end?

2 of these 5 have same role "sn_grc.business_user" along with some other roles. So what's the resultant here?

Thanks