Restrict view access for service portal widgets

[Sam31]

Hi All,

I’m trying to lock down an icon link widget on the portal to specific groups, but it only worked on my non-production instance and not my production instance. I did the following:

The ‘Com.glide.service-portal.user-criteria’ plugin was installed on my production and non-production instance.

On the user criteria table, I created a new record called ‘Finance’ and added the _All Finance Users Active Directory group to the record. This is populated in the groups table.

I have an icon link widget on the service portal for the walk-up experience. When I open in the platform option [SP instance config view] in the non-production instance, the below options appear.

I added the Finance criteria record to the can view option and removed any role. This worked when testing it in non-production and as far as I can remember, these were the only steps taken.

When copying this over to production manually, the image above did not appear, and I tried to import it into the form but was left with the below:

I did persist and add the user criteria record for Finance and added the group again. I then added this to can view but when I went to test, it didn’t show for members of that group.

Has anyone got any ideas of what went wrong or a different/better way to do this?

Thanks,

Sam

[Alberto Consonn]

Hi,

follow these steps in your production instance, it should work:

https://docs.servicenow.com/bundle/madrid-servicenow-platform/page/build/service-portal/task/widget-...

If I have answered your question, please mark my response as correct and/or helpful so that others with the same question in the future can find it quickly and that it gets removed from the Unanswered list.

Thank you

Cheers
Alberto

[Sam31]

Hi Alberto,

I did originally follow the documentation but couldn't go further after the ability to change who can view didn't appear in the related lists as shown below:

Is there an additional action I have to do to make this appear?

Sam

[elijah_reynolds]

Hi Sam,

The related list won't appear if the User Criteria system property isn't enabled. 

Set the value to true and the option will appear.

Here is the full name of the property:

glide.service_portal.user_criteria_enabled

Hope this helps,

Elijah

[ChandC]

If it works in dev but not prod, it's data, not config — compare the group membership, not the setup.

Three things to check in production, in order. First, impersonate an actual Finance user and test — admins bypass user criteria, so testing as yourself proves nothing. Second, verify the AD group actually populated sys_user_grmember in prod; AD group imports differ between instances all the time, and an empty group matches nobody. Third, confirm the user criteria record itself made it over — "Can view" on the widget instance references the criteria by sys_id, and a manually recreated record is a different record.

The better long-term approach: manage the criteria in an update set like any other config, and add a scheduled check that alerts when the group membership count drops to zero. Silent group sync failures are the #1 cause of "it just stopped working."