Brazil upgrade - error with field encryption starter

[Tom Brown]

We installed Brazil patch 0 on one of our sandboxes to do an evaluation.  We started seeing an error pop up in SOW and other areas.  "Execute operation on API 'Glide API: string utilities' from scope 'Field Encryption Starter' was denied. The application 'Field Encryption Starter' must declare a cross scope access privilege. Please contact the application author to update their privilege requests."

Some buttons didn't render, although I can't confirm it was due to this same issue.  Brazil patch 1 did not resolve it, and we opened a case with ServiceNow.  They rolled it into PRB2078372.  Field Encryption Starter is a private application, but I could see where there were several cross-scope privileges defined as part of the application even though I couldn't edit or add one in that scope.  I eventually tried to repair the field encryption starter application, and it resolved the red box and the buttons came back.  We have asked if this is the permanent solution or will we see this come up again.  SN is still looking into it at this time.  But in case anyone else sees this box, you might try the repair yourself.

edit:  a curious observation is that in our Zurich instances, the Field Encryption Starter plugin shows 76 files under version 1.0.0.  In the Brazil one that I 'repaired', it shows 564, also in version 1.0.0.  Maybe 30 cross scope privileges in the repaired one, only 10 in our Zurich instances.  Running the repair on the Zurich nonprod resulted in 77 files total, still 10 cross scope privileges.  so v1.0.0 in Brazil is different than v1.0.0 in Zurich, for whatever that's worth.

[AndrzejP]

Got the same error after upgrade from Zurich to Brazil Patch 1.

[Tom Brown]

Did you try the repair on the field encryption starter, and if so, did it also work for you?  If you want to follow PRB2078372, you could open a case with SN about it and mention the PRB number.

[moulimonish]

I encountered this issue after the patch update. I tried to create a new Cross-Scope Privilege record, but I couldn't switch the application scope to Field Encryption Starter to set it as the source scope and Global as the target scope.

So, I tried the following Background Script to create the privilege record and change its status to Allowed. After executing the script, the issue was resolved.

Do you know of any other recommended or permanent way to resolve this issue? Is modifying the Cross-Scope Privilege record through a Background Script a safe approach?

---------------------------------------------------------------------------------------------------------------------------------------

var privName = 'Glide API: string utilities';
var scopeId = '8960d4ec532f82105751ddeeff7b1257';

var check = new GlideRecord('sys_scope_privilege');
check.addQuery('source_scope', scopeId);
check.addQuery('target_name', privName);
check.addQuery('operation', 'execute');
check.query();

if (check.next()) {
gs.info('Already exists. Status: ' + check.getValue('status'));

if (check.getValue('status') != 'allowed') {
check.setValue('status', 'allowed');
check.update();
gs.info('Status changed to allowed');
}
} else {
var priv = new GlideRecord('sys_scope_privilege');
priv.initialize();
priv.setValue('source_scope', scopeId);
priv.setValue('target_scope', 'global');
priv.setValue('target_name', privName);
priv.setValue('target_type', 'scriptable');
priv.setValue('operation', 'execute');
priv.setValue('status', 'allowed');

var newId = priv.insert();

if (newId) {
gs.info('Created privilege record: ' + newId);
} else {
gs.error('Insert failed. Check the privilege form values or try Elevate role (security_admin).');
}
}

[Tom Brown]

Personally, I'd rather stay with the SN Out of the box record, just in case they modify or remove it at some point.  I would think that the Repair or waiting on the patch 2 fix is probably recommended by SN.