hi everyone in this video we are going to take a look at implementing another Access Control list rule this is part two in a series so if you haven't already looked at part one I invite you to do so in that video we take a look at implementing two separate Access Control list rules in this video we're going to take a look at implementing one more it's going to be a simple requirement but it will allow us to highlight and reinforce some basic principles of implementing ACLS so let's get started so the requirement that we will work with in this video is the following as a group manager I need to be able to edit my group that I'm a manager of in order to maintain the group description a very simple requirement but one that can pose some difficulties it can be a little bit tricky if you are not really sure about how Access Control lists work if you remember our first video what was the Golden Rule the first thing that you need to do whenever implementing or when confronted with a security requirement or in fact any requirement in the platform you need to see what currently exists in the platform how do you know if you need to create a new record modify an existing one or maybe not do anything at all because in fact the requirement is as it currently is in the platform so let's take a look now at this requirement and what we currently have for modifying group records in servicenow okay let's start off by looking at a group record from the perspective of the manager of that group in this case I am logged in as Beth Anglin she is the manager of this group and as you can see she does not have right access it's read access only so let's take a look at the access control rules for the group table I'm going to switch over to my system administrator session here and go straight to the groups list which is the quickest way I find to get to the ACL so just go to the list or the form for that table and then to come to the configure menu here and then go to table you can go to security rules as well but they will also show you the ACLS for any parent tables in our case there are none so it doesn't really matter so I'm going to go to table and come down the bottom here to my ACLs and we're only interested in looking at the right ACLS for the entire table so let's quickly filter this list let's show only the right ACLS for the entire table okay so we can see here we've got three so now we just need to go through each one to see what the conditions are and that will be the difference between all three the access control rule is the same it's a right Access Control rule for the table the difference would be what conditions you need to fulfill in order to get that ACL so in this case you need the agent schedule manager role let's look at the second one this one you need the skill admin or the user admin role you don't need both so when you have multiple roles here in ACLS they are separated by an or operator so you need one or the other here and it's different actually if you have a condition here because then it will be an end condition between the rolls and the conditions so I would need to either have the user admin or the skill admin role plus I need to fulfill whatever condition is in here let's look at the third and last one and here we need either the scrum admin or scrum Master role okay so for our requirement where the manager needs to have right access none of those are appropriate we could actually go ahead and modify any one of those but then we would be adding another condition to an existing one so not only would you need to be a manager of that group you would need to have whatever role is specified in that ACR so in actual fact we need to create a new ACL so let's go back to our list of ACLS and let's go ahead and create a new one Okay so we've got the the table here we haven't got any other restrictions for the ACL that's actually for the entire table so we'll just leave that as it is and if I scroll down we just need to create a simple condition here to see where the manager field and here we can take advantage of this Dynamic operator here is dynamic and then it will default to me there are other options here as well but again translated into plain language that will mean the currently logged in user they are the manager they'll have right access so let's go ahead and save that okay now this actually will not work as is let's go down to the ACLS here let me remove the filter for the table so we can see all right ACLs so we can see here we've got now four for the entire table but we can you can see here also that we've got some other ecos right ACLS for specific fields and also with this wild card which means every other field for which there is in a specific ACL okay so if I come back to Beth here and just refresh the page you shouldn't need to log out and log back in as long as you haven't changed role assignments it should be fine just to refresh the page the system will take a look at that new ACL and we can see here nothing's changed she still has read access only do you know why just take a moment to think about that why doesn't she have right access at this point do you know well we've granted her right access to the table that's step one we need to do that absolutely if we don't do that there is no way known to mankind that she will be able to have right access to that table okay but once she gets in once she gets through the front door if you like we've also got these other ACLS so at the moment we've got these Wild Card ACLS we've got these specific ACLS here for specific fields and Beth is not assigned or the manager is not part of the condition for any of these ACLs so at the moment managers can get in they've still got read access but they can kind of got right access but for no fields in the table so that's what we need to change here so in our case we actually need to add another ACL second one with the wild card here to say let's create access to all Fields except for these three Fields here because they have their own special ACLs okay we could browse and open up each one but just to save a little bit of time we'll just go ahead and create a new one because I know already but that these ones are associated with other roles and they are not suitable to be modified in our case we need to create a new one so let's do that click on New Again and this time we'll go ahead and specify that asterisk that wild card in other words an access control rule once we get into the table itself What fields can we change all fields again except for those three ones that have their own ACL and if we scroll down we just need to put the same condition in here that we had before so where the manager field is dynamic me and that's it submit so again when you're creating ACLS just pay attention to what ACLS there are not only for the entire table but what ACLS there may be for specific fields or maybe those Wild Card ACLS for every field except for those acrs for a specific field okay so let's test this let's go back to Beth and refresh the page and now we can see she has right access now to these fields name she could actually change the name select another manager add a description here change the email address but she can't change the parent there's actually a good reason for that do you know why perhaps now you while you're thinking about an answer to that question let's go back and have a look at the ACLS again and we can see here for that field that parent field there is a separate Access Control rule okay so if we open up that one what conditions do you need to fulfill you need to have either the user admin role or the admin role okay so that's restricted okay and there is actually a very good reason for that again do you know why has to do with the way roles are inherited and group roles are inherited so if you specify a group here this group the service desk group will inherit all the roles that come from that parent group that that parent group has so if you were to give a user the ability to change this field they could theoretically come in here and see okay let me put the admin group in there the admin group that has the admin role now I've been tested this but it could probably mean that the users in this group in the service desk group would also get the admin role from that group now I'm not actually sure if that would work because there are usually some extra checks and balances whenever you're assigning the admin and the security admin roles but for any regular group with some regular roles they would flow down to any child groups as well and actually in it's best practice you shouldn't necessarily do that it makes role assignment a little bit more complicated because roles can contain other roles and there's that method as well for assigning more than one role to a user by the group so but that's a topic for another day so that's it everyone that's how you would go ahead and Implement yet another Access Control list story it was a very simple requirement but as I said you do have to be a little bit careful because there may be access control rules not just for the entire table but for individual fields and also for every other field with that asterisk Access Control rule so just granting access to the table itself may not necessarily be enough okay so I hope you found this video helpful and we'll see you next time bye for now foreign [Music]