Requires Access To:
- Database server
- Service Desk console
How To:
This article is intended to understand how privileges are organised in the Service Desk database so as to help in some situations of troubleshooting.
First things first:
When a privilege is modified from the administration component in the console, it immediately modifies the value in the database without pressing the Save button. It will then set the right value for the relevant privilege of the role or group that is modified.
Structure:
The privileges configuration is defined byt the following tables in the database:
- md_privileged_item, where is the definition of all the privileged items in Service Desk
For instance, the Incident Task action "Add Note" has a related privileged item
- tps_privilege, contains the values of privileges. This is where we know what privilege is enable or not (... for a specific group or role).
Each value is of course associated with its privilege definition (md_privileged_item) - tps_privilege_collection, this table links a group or a role to a whole of privilege values.
This table gives Service Desk the capacity to associate either a group or a role to a configuration of privileges.
- tps_group or tps_role, which are the tables that store the definition of groups and roles in Service Desk.
The global structure is represented below:
Summary and example:
In this example, we want to amend a privilege of the role SelfServiceUser.
We set the "Execute" privilege to true for "Modules > Incident Management > Process Related Object > Task Incident --> Add Note".
Role (tps_role):
In the database: the tps_role (role) entry "SelfServiceUser" has a link to its associated tps_privilege_collection (collection) entry.
| tps_guid | tps_name | tps_privilege_collection_guid |
|---|---|---|
| 8CF30EF0-B4EF-4BEA-860A-8177CF01B69B | SelfServiceUser | F70C5099-BC5F-418C-846E-1F7202F3F364 |
Collection (tps_privilege_collection):
The tps_privilege_collection table will simply store the list of existing collections for both roles and groups.
| tps_guid |
|---|
| F70C5099-BC5F-418C-846E-1F7202F3F364 |
Privilege Values (tps_privilege):
In the tps_privilege table (the privilege value), there's a value change (...to 16) for the entry that is bound to the above role collection and to the privileged item "IncidentManagement.Task.Function.AddNote".
| tps_guid | tps_item_guid | tps_collection_guid | tps_value |
|---|---|---|---|
| C9343EB4-48D1-40B0-956D-31E3509C9AA3 | 89A1B087-6484-426A-809C-3FA4DFEA9599 | F70C5099-BC5F-418C-846E-1F7202F3F364 | 16 |
Privilege Definition (md_privileged_item):
The above column "tps_item_guid" refers to the privilege definition in the md_privileged_item table:
| md_guid | md_name |
|---|---|
| 89A1B087-6484-426A-809C-3FA4DFEA9599 | IncidentManagement.Task.Function. |
Additional information:
From the version 2016.1 of Service Desk, Test to Live doesn't transfer the privileges of existing groups and roles
If a privilege has never been configured, it's deactivated by default and there will be no associated entry in the "tps_privilege" table. Changing this privilege for the first time will create a new entry in this table.
Comments