Permissions on new field in Sys_user table

[riaz_mansuri]

Hi,

Currently the sys_user table is read only for users with an ITIL licence.

I want to create a new field and give write permissions to users with an ITIL licence or better yet only to a specific group.

Does anyone know how I can achieve this?

Thanks,

Riaz

[Chuck Tomasi]

Hi Riaz,

This takes a few ACL rules...

Create a WRITE rule on sys_user.none for roles admin, user_admin, and itil.

Create a WRITE rule on sys_user.* for admin (and user_admin) roles. That gives them write access to all fields.

Create a WRITE rule on sys_user.fieldname for the itil user. They cannot write to all fields, just this one.

[Chuck Tomasi]

FYI -

Docs: Access control rules

Docs: Contextual security  

Security Best Practices - ServiceNow Wiki

[SanjivMeher · Accepted solution]

To create an ACL, you need security_admin role.

Open System Security-> Access control and create an ACL with table as sys_user and field name as your new field name.

On the bottom, add the new role you created.

Then grant that role to the group.

[riaz_mansuri]

Thanks - I created a New role then an ACL and granted that role permissions to that field.