CA Service Management

In some dropdowns, we restrict who can see specific entries by using a data partition based on access type.  I now have a need to do a similar restriction based on Service Desk Groups.  If anyone has done this and can give let me know who or point me to some documentation, I would certainly appreciate it.

We are on Service Desk 14.1 and this is specifically for the Status on Requests.

Many Thanks!

Victor

Hi Victor,

If I am understanding the need correctly, you are looking to restrict the values that appear in some of the dropdowns, but this time, based on group, is that correct?  If so, this is a bit tricky because it depends on which dropdowns specifically you are trying to restrict, and whether those dropdowns (whatever object they are) had a group attribute on them or not.  The limitation with data partitions constraints is that you cannot cross objects or use an "if then" type statement.  Additionally you can also only have one constraint of each constraint type (update, view, pre-update etc.) on an object.

So for example, lets say the dropdown field you wanted to restrict by group is the "symptom" field.  You cant have a constraint that says you cant view the symptom called "high CPU usage" IF you are in group XYZ.    If the symptom field had a group attribute on it, you could restrict it in a way such that the logged in user would have to be a member of the group in which that symptom value is associated with.  BUT, most drop down fields don't have the group attribute, so it will be difficult to do this.

If you can provide us with a few use cases here of specifically what fields you are looking to restrict by group, we can give you a better idea of what options are possible.

Let us know,

Thanks,

Jon I.

Hello Jon,

   Thanks for taking the time to add this information!

   My current need is for the Status attribute on the Change object.  We would like to have a status like 'Security Review' in the dropdown but only allow members of the Security group to be able to put the CO in that status.

   I could do this by creating an access type for members of this group and then creating a data partition constraint on all other access types to not see this status but if I could accomplish this using the Group, it would be preferable.

   Thanks again!

Victor

If you are willing to customize your htmpl files, you can achieve it with a pdm_list.

Here's a piece of code i use to determine if the current user is flaged as a manager of the request group, or if he is the supervisor of the request group.

<PDM_IF "$args.group" != "">
<PDM_LIST PREFIX=list1 FACTORY=grpmem where="group = U'$args.group' AND member= U'$cst.id'" ESC_STYLE=JS2>
<PDM_IF "$list1.manager_flag" == "1">
<PDM_SET args.isGroupManager=1>
<PDM_ELSE>
<PDM_IF "$args.group.supervisor_contact_uuid" == "$cst.id">
<PDM_SET args.isGroupManager=1>
<PDM_ELSE>
<PDM_SET args.isGroupManager=0>
</PDM_IF>
</PDM_IF>
</PDM_LIST>
</PDM_IF>

You should be able to work it out with this example

PS : You need to edit the file : detail_cr.htmpl. You may consider using the Web Screen Painter to avoid overriding the OOTB file. Or you can copy it manually from bopcfg to site folder.

Src : \D$\CA\Service Desk Manager\bopcfg\www\htmpl\web\analyst

Dest : \D$\CA\Service Desk Manager\site\mods\www\htmpl\web\analyst

Hope this helps.

Hello POssq,

   Thanks for taking the time to send this possibility!

   In looking at your example, I can see how I might be able to make a slight change to it and use it to make the entire dropdown visible to only members of a specific group.  However, I don't see how I would use this to restrict who could see a specific selection in the dropdown.

   If I'm missing something here, please let me know.

   Thanks again!

Victor

You seems fairly new to SDM customization so my apologies for an unexplicated answer like this one

The pdm_list will allow you to retrieve if a particular user is a member of a particular group.

With that, you will be able to add a pdm_if to your htmpl page, and customize the status dropdown :

You can replace the status dropdown with this piece of code, assuming that you're using the $args.isMemberOfSecurityGroup variable to store if the user is a member or not of the specific group.

<pdm_if "$args.isMemberOfSecurityGroup" == 1>

<pdm_macro name=dtlDropdown hdr=Status attr=status>

<pdm_else>

<pdm_macro name=dtlDropdown hdr=Status attr=status whereclause="sym !='Security Review'">

</pdm_if>

Hope this clarifies,

Pier

So to summarize :

First:

The pdm_list tries to retrieve the record corresponding to "User A is member of group B"

If it finds a record, you will set "1" to a custom variable with pdm_set

Second :

With the custom variable containing etiher 1 or 0, you can then create a condition to display a dropdown with every values, or a dropdown with a whereclause to "remove" a value from it.

Regards,

Pier

Hi pier-olivier.tremblay,

Im curious, does this use  pdm_list wrapped around if statements slow down processing time? 

If there isn't a noticeable difference in page load time I may investigate this. 

I did not noticed any performance issue with this code.

My pdm_list returns only one record so there's no looping. If you query the complete grpmem table, and then compare with "if" statements if a user is a member of a group, you may notice a difference in loading time.

The code i provided is used to make "priority" a readOnly field if the connected user is not the supervisor nor a manager of the group to wich the ticket belongs. You can apply to a lot of scenario. Just ask if you are not sure.

Hi Victor,

What you are trying to do does make sense, however I dont think you can do it via a data partition because there is no relationship between groups and statuses, and you cannot do an "IF THEN" statement to say IF @rootid is in group xyz, THEN show value "security review".    SO, I think that the only way you can do this is by creating an access type and hiding that value from all other access types (technically its roles, not access types, but I know what you meant  ).

hope this helps,

Jon I.

Thanks again Jon,

   This is what I thought might be the case but I was hoping someone had found a way to filter the selections by group.

   I'm going to go ahead and create the access type or role and do it that way.

Victor