RCA Errors in HR scoped application after upgrading - Known Error

RCA Errors in HR scoped application after upgrading Description During an upgrade, the "Caller Access" value of non-customized Script includes in the HR scoped applications that were set to None may be switched to Restricted as a result of out-of-box updates.

This can result in Restricted Caller Access (RCA) errors in certain HR functionality. For example, when submitting requests from the Employee Service Center (ESC) or HR service portal.

Errors similar to these might be seen:

Execute operation on script include 'hr_ServicesUtil' from scope 'Global' was denied because the source could not be found. Please contact the application admin Execute operation on script include 'hr_ServicesUtil' from scope 'Global' was denied. The application 'Global' must declare a cross scope access privilege. Please contact the application admin to update their access requests. This affects older Script Includes that existed prior to the Kingston release, which was initially set to "Caller Access" None on the first post-Jakarta upgrade for backward compatibility (The "Caller Access" field was added in Jakarta). During additional upgrades, any of those Script Includes that receive out-of-box changes from development features or defects can result in having the "Caller Access" being changed to Restricted .

This can cause functional issues if there any customizations that reference any of those Script Includes if they don't have any related Restricted Caller Access (sys_restricted_caller_access) record with "Status" set to Allowed and "Source Scope" set to the calling scope.

This could affect any of the following Script Includes:

HR Core HR SP HR LE hr_CaseHierarchyUtils hr_AssignmentAPI hr_AssignmentUtil hr_CaseUtils hr_license hr_SysUser GeneralHRForm hr_TemplateOwnership hr_BulkCaseUpload hr_PdfUtils hr_Task hr_Case HRCoe HRBenefitTables hr_Profile hr_Login_Authenticator hr_TemplateUtils hr_ServicesUtil hr_Criteria hr_MySubjectStats hr_CoreUtils hr_PortalContent emailUtil hr_PortalUtil hr_TaskTicket DTUtil hr_LEType hr_ActivitySet hr_ActivitySetTrigger hr_ActivityUtils hr_le_coe_config

Steps to Reproduce

Upgrade to London or later release with HR scoped applications installed. Notice any issues after upgrade (e.g. RCA errors submitting cases on HR Service Center / Employee Service Center, RCA errors in log). Go to module System Applications > Application Restricted Caller Access and search for a record with "Target" referring to one of the previously-mentioned Script Includes and " State " NOT Allowed . See that there are records in Requested state, with "Target" referring to one of the previously-mentioned script includes OR there are NO records with "Target" referring to one of the previously-mentioned Script Includes and "Source Scope" set to the scope the mentioned in the RCA errors. Workaround Do one of the following:

Allow access for any new privilege file(s) that were generated: Go to module System Applications > Application Restricted Caller Access Set filter to "Status Is Requested" Set the Status to "Allowed" for any records that are "Requested" and have "Target" set to the specific script include that is not working. If there isn't any existing RCA record with "Target" set to the specific script include that is not working and "Source scope" set to the scope where the Script Include is being called form, create a new RCA record for it. 3. OR Reset the Script Include that is causing errors to "Caller Access" = "None" (disables RCA).

Note: This may make it harder to get out-of-box updates

For example, if the error messages you are getting are:

Execute operation on script include 'hr_ServicesUtil' from scope 'Global' was denied because the source could not be found. Please contact the application admin Execute operation on script include 'hr_ServicesUtil' from scope 'Global' was denied. The application 'Global' must declare a cross scope access privilege. Please contact the application admin to update their access requests. Check whether there is any RCA record with "Target" = script include "hr_ServicesUtil" and "Source Scope" = "Global" :

/sys_restricted_caller_access_list.do?sysparm_query=target%3De0d7bdf79f031200d9011977677fcf15%5Esource_scope%3Dglobal

If any such record exists, check their "Status" and make sure it is set to "Allowed".

If no such record exists, move to the Human Resources:Core scope and create a new RCA record with:

Source Scope: Global Source Type: Scope Status: Allowed Target Scope: Human Resources: Core Target Type: Script Include Target Table: Script Include [sys_script_include] Target: hr_ServicesUtil Operation: Execute API More information can also be found on the documentation: HR Service Delivery upgrade information Related Problem: PRB1357095