question Re: Forced encryption on attachments in ITSM forum

Forced encryption on attachments

Kim Sullivan — Thu, 27 Jul 2023 15:23:42 GMT

Since upgrade to Utah, all our attachments are being encrypted. In Tokyo and before there was a checkbox here to choose to encrypt. That is now gone and none is not the default option.

ServiceNow support says this is OOB, but I can't believe this was intended.

#encryption

#crypto

#attachments

Re: Forced encryption on attachments

Kim Sullivan — Thu, 27 Jul 2023 20:51:57 GMT

HI told me to post on community and this was an OOB setting. I spent another 3 hours on it and figured this out --

update the optional_attachment_encrypt UI macro.

OOB config:

Updated:

You also need to comment out these lines:

Re: Forced encryption on attachments

Todd Preece — Wed, 02 Aug 2023 21:57:38 GMT

Took me some time to investigate this but at least in the context of Column Level Encryption (CLE), the option to encrypt or not is controlled by a system property 'com.glide.encryption.enable_attachment_key_ui'. True=Give the option, False=Encrypt by default. I tested this out on a Utah instance and seems to toggle the choice as expected.

Re: Forced encryption on attachments

Kim Sullivan — Fri, 04 Aug 2023 14:10:34 GMT

@Todd Preece

Hey Todd - thanks for looking into it. I already have this property set to true.

Re: Forced encryption on attachments

Jeff Boltz1 — Wed, 18 Oct 2023 17:49:57 GMT

Has anyone had a case where attachments do not encrypt if the property com.glide.encryption.enable_attachment_key_ui'. is set to false?

Re: Forced encryption on attachments

Jeff Boltz1 — Fri, 20 Oct 2023 15:17:15 GMT

Additional property:

glide.attachment.encrypt_by_default

Export the XML before you mess with it as it can not be reverted. Check with SN first maybe?

Re: Forced encryption on attachments

Sadrudeen Ashra — Thu, 26 Oct 2023 13:54:16 GMT

I was looking for something like this and tried your solution, it worked and it defaults "None" but still it selects the encryption by default when the "Attachment" pop-up loads.
Even if we provide selected="Selected" it still goes for encryption. The only way is to select "None" and choose the attachment.

Re: Forced encryption on attachments

Kim Sullivan — Thu, 26 Oct 2023 14:22:35 GMT

Can you post your optional_attachment_encrypt UI macro for me to review? Also, please make sure you have updated the system property per Todd's post below.

Re: Forced encryption on attachments

Sadrudeen Ashra — Thu, 26 Oct 2023 14:43:24 GMT

system property 'com.glide.encryption.enable_attachment_key_ui' = false , hides the entire dropdown itself and adding an attachment with no option selected again encrypts the file.
Attached file for your review.

Re: Forced encryption on attachments

Kim Sullivan — Thu, 26 Oct 2023 15:43:59 GMT

Your macro looks fine. And on the system property, apologies, I was thinking of this one glide.attachment.encrypt_by_default. Set it to false. Update that and let us know if it worked for you.

Re: Forced encryption on attachments

Sadrudeen Ashra — Thu, 26 Oct 2023 15:56:30 GMT

I dont have the property glide.attachment.encrypt_by_default. when I tried to create it, I got the "Error Message

Not allowing set of unsafe property value: glide.attachment.encrypt_by_default=false
"

Re: Forced encryption on attachments

Kim Sullivan — Thu, 26 Oct 2023 15:58:48 GMT

hmm... you may want to open a case with HI on that or see if one of the ServiceNow employees on here will comment.

Re: Forced encryption on attachments

Steven Parker — Fri, 17 Nov 2023 16:29:54 GMT

ServiceNow released a KB on this although the code isn't accurate (they left the choiceValue variable in the fixed code populated with the jvar_current_encryption_model):

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1560873

But I do have a question...why do we need to comment out lines 34-36? It seems to work fine without that commented out.

Re: Forced encryption on attachments

Kim Sullivan — Fri, 17 Nov 2023 16:25:29 GMT

In my instance, a default encryption is being applied for all my users. I needed to comment out those lines, so that wouldn't happen.

If it works for you without... great!

Re: Forced encryption on attachments

Steven Parker — Fri, 17 Nov 2023 16:31:34 GMT

Ahh gotcha! Thanks for the very quick reply. Apologize about my first post as that came off as rude...I was frustrated with ServiceNow's own KB having the code wrong (see my previous post as I've updated it).

Re: Forced encryption on attachments

Nanditha Aitha — Wed, 13 Dec 2023 19:55:14 GMT

Hi Ashra,

I am experiencing the same problem like yours. Have you found any solution for this?

Thank you,

Nanditha

Re: Forced encryption on attachments

alex_upmann — Mon, 01 Jan 2024 19:53:52 GMT

I have this same issue on my instance but when I follow the link to the knowledge article, I get a message saying my role doesn't grant me access to the article. Now I can take that up with SN and my SN account manager but can you list the pertinent points from the article?

Re: Forced encryption on attachments

Eugene Severi — Wed, 27 Mar 2024 23:08:44 GMT

We tried to update the glide.attachment.encrypt_by_default value to false all ways I could think of, they all failed.

In the end, support needed to set the property directly on the db on our behalf. Can confirm once changed it works!

Files which are attached to tasks i.e. Incidents using drag/drop will no longer be encrypted by default.

Re: Forced encryption on attachments

Kim Sullivan — Tue, 30 Apr 2024 14:58:17 GMT

Update to this -- when you use the REST step in Flow actions and choose Save As Attachment, the files are defaulting to encrypted, despite all the default encryption being turned off per this article. I don't see a way to change this and have a case open with Support on it.

Re: Forced encryption on attachments

Anupriya23 — Thu, 20 Jun 2024 14:29:15 GMT

I am facing the same issue only with HR module, all the attachments are getting encypted by default when property com.glide.encryption.enable_attachment_key_ui is false in the syatem.

Modifying macro doesn't help, started happening after washigton upgrade it seems .

checked the Column Level Encryption (CLE), which is active true for HR cases but also unable to deactivate these by our own.