Getting errors while creating a dependency assessment in BIA - Support and Troubleshooting

Getting errors while creating a dependency assessment in BIA Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } When trying to create a dependency assessment in BIA, an error occurs with the following messages: 'Part of the query on sys_ui_element has been ignored because of insufficient access for 'query_match' operation on sys_ui_element.element', 'Part of the query on sys_ui_element has been ignored because of insufficient access for 'query_match' operation on sys_ui_element.type', and 'Part of the query on sys_ui_element has been ignored because of insufficient access for 'query_match' operation on sys_ui_element.sys_ui_section'.

Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } As a part of Vancouver, Washington and Xanadu release, there was a feature added to plug a security risk where a user can query for data that they don't have explicit read access to. The error message seen in this is because of the same feature. It is likely that the user does not have access to certain fields (the same one in the error message: "Part of the query "). This is therefore an expected error message.

Background: Earlier, we had allowed users to build queries on tables using any field, even those fields that they did not have explicit read access to.

This issue posed a security risk, as users who did not have read access to a field could try to filter on that field in the list and potentially deduce the value in that field.

This issue (PRB1716537) was fixed in the Washington release, and in the latest patches of the Utah and Vancouver releases, and in Xanadu by introducing the new ACL behavior. As a result of fix, when you upgrade, the same list query which worked earlier will break and display the error "Part of the query on has been ignored because of insufficient access for on . ".

i.e., users who do not have access to the perform a "query match" operation on "sys_ui_section.view.name" field of sys_ui_element.

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } A) To mitigate this issue, you have to create new "query_match" operation type of ACL with the respective table and field i.e., table = sys_ui_element on element field or type field etc. such that the users can perform the query match on this table.

query_match → Enables users to submit match queries("is", "is not", "is empty", etc).

After which the issue would be resolved.i.e., Now upon impersonating Thomas Ulmer and adding the dependency you would not be able to view the error and business rule would be executed as expected.

For more details, please refer below documentation:

https://docs.servicenow.com/bundle/xanadu-platform-security/page/administer/contextual-security/concept/acl-rule-types.html https://docs.servicenow.com/bundle/xanadu-platform-security/page/administer/contextual-security/concept/query-acl-rule.html https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1705620

B) Also, this error message can be hidden from all users by creating and setting the below System Property and setting its value to false: 1. All > sys_properties.LIST > Click on "New" 2. Fill in the details as follows: Name: glide.db.encoded_query.field_acl_error_msg Type: true | false Value: false 3. Click on Save

However, this is a GLOBAL property and will hide the message from all queries where the user does not have read access to one or more fields they are querying on.

Please view the following knowledge article to understand more about the issue and workaround: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1882675