User Scoping Problems

Paul_Dalkin

Hi Can anyone tell me whether this issue in the image occurs because the user role isn't scoped to at least one CI group? The AD User picker wouldn't insert the user into the form. I created a new user role that had to be different from other existing roles and the scoping has been a problem. Has anyone disabled scoping for their own portal (https://support.cireson.com/KnowledgeBase/View/33#/)?

carrie_medine

Hello Paul,

Please review this KB:  https://support.cireson.com/KnowledgeBase/View/1275#/

Specifically the piece about:   If a non-analyst user is scoped to Create On Behalf Of, they must have access to a Configuration Item group containing AD Users within an SCSM console role. By default, the out-of-box End User role does not have this permission.

Hopefully that helps,
Carrie

carrie_medine

This KB may be helpful in determining where the scoping needs tweaking:  https://support.cireson.com/KnowledgeBase/View/35#/

The following query on your ServiceManagement db will show whether or not a user is scoped or unscoped for each type of object:

SELECT U.UserName,SU.IsConfigItemScoped,SU.IsWorkItemScoped,SU.IsServiceCatalogScoped

FROM ScopedUser SU

INNER JOIN CI$User U ON SU.UserId=U.Id

WHERE U.UserName='travis'

In the results the 0 means that the user is not scoped.  1 means that the user is scoped by something - a queue for work items, a group for configuration items, or a service catalog group for service catalog content.

carrie_medine

Hello Paul,

Please review this KB:  https://support.cireson.com/KnowledgeBase/View/1275#/

Specifically the piece about:   If a non-analyst user is scoped to Create On Behalf Of, they must have access to a Configuration Item group containing AD Users within an SCSM console role. By default, the out-of-box End User role does not have this permission.

Hopefully that helps,
Carrie

Paul_Dalkin

Thanks Carrie, this person is in a nested group within the AD SCSM-Analyst group. However, strange thing is that the SCSM user group they are part of does not have these CI group access permissions. Currently (until I learn more) it appears this is over-riding the permissions granted to them through their [albeit nested]  Analysts AD group membership. Ah, this takes me back to the good old days of inheritance rights' filters when moving from Novell to Microsoft AD..... 

carrie_medine

This KB may be helpful in determining where the scoping needs tweaking:  https://support.cireson.com/KnowledgeBase/View/35#/

The following query on your ServiceManagement db will show whether or not a user is scoped or unscoped for each type of object:

SELECT U.UserName,SU.IsConfigItemScoped,SU.IsWorkItemScoped,SU.IsServiceCatalogScoped

FROM ScopedUser SU

INNER JOIN CI$User U ON SU.UserId=U.Id

WHERE U.UserName='travis'

In the results the 0 means that the user is not scoped.  1 means that the user is scoped by something - a queue for work items, a group for configuration items, or a service catalog group for service catalog content.

Paul_Dalkin

Thanks Carrie!