CA Service Management

Hello, I would like to create some additional object when activity log is created. For this I use the following code

send_wait( 0, top_object(), "call_attr", "zmyobject", "get_new_dob", NULL, NULL, group_leader);

     if (msg_error()) {

      logf(ERROR, "get_new_dob failed %s", msg[0]);

     }

     newzmyobject= msg[0];

     newzmyobject.description = description;   

     newzmyobject.request = call_req_id;

     newzmyobject.contact = analyst;     

     send_wait(0, group_leader, "checkin");

     if (msg_error()) {  

      logf(ERROR, "checkin failed %s",msg[0]);

     }

Everything works fine, but I would like to disable this functionality for some particular roles by using data partition constrains. I was expecting that I will get an error, if this script will be initiated by user with data partition constraint,  that does not allow creation of the object. But it seems that my spel is ignoring constrains, while in web interface everything working as expected.

Maybe someone knows some other, data partition aware, method for custom object creation.

Thanks

Hi,

I think that data partitions didn't affect any spels because all of them (or most of them) are executes as system user.

I've created new data partition with PRE-UPDATE type,

then raised exception with maximum logging level,

so I can get that PRE-UPDATE constraint is called in do_checkout OOTB function,

but as we know there is no public way to get it content.

There should be some function to automate constraint check,

but the only way I found is to:

1. Pass $SESSION.ROLE_ID to Act Log:

<input type=hidden name=SET.z_role_id value="$SESSION.ROLE_ID">

2. Then call a lot of data to get acutal whereclause constraint.

3. Check your data.

Good luck.

Hi cdth,

I don't know OOTB function do_checkout. Could you provide some example how to use it.

Or do you mean this function send_wait(0, group_leader, "checkout", atev_dob);

hi,

yes, it is.

I also noticed that when you execute any macro from attached event, group leader is already defined and there is no need to call "get_co_group",

so I think that user session (including current role) is contained in "group_leader" object.

I produced dum_args(group_leader) funtcion which shows all attributes of current object and if I catched correct information it contains current user session.

I hope that there will be some method like "current_user_id" which returns group_leader of current acting user,

and if my theory is correct you can execute all scripts as some user whom group_leader you got.

Regards,

cdtj

could you share your dum_args() function?

my bad it's dump_args(object);

function declared in freeaccess.spl which is not presented in majic folder and located in www folder (to execute via webengine ops),

first try to get dump_args(group_leader) i received error : unknown method dump_args,

after I copied freeaccess.spl to bopcfg/majic i received next error : 493 Unknown message get_arg_list received in COGP:OB:MTH:

all logs from dump_args are on VERBOCE and TRACE levels.

If I try to execute it from trigger triggered spel I get an error:

Attempt to call unknown function dump_args

has updated previous post,

if get_arg_list is declared in domsrvr or somewhere else where we can't access it,

it seems to be the end of research

here is some new info:

\Service Desk Manager\bopcfg\interp\conflict_analysis.frg function which used to validate storded query and user;

logf(SIGNIFICANT, thread_userid()); returns userid, I always get superuser, if call it from atev or majic both.

but thread_userid() shows actual user if I call it from WebEngine OP.

hope this helps...

Yes it seems that spel from the trigger is always run as superuser. The only way to have constrains to work is to impersonate as other user. But there is no such method known at the current time

SOURCE CODE: z_get_user_privileges