Limitations of the SOAP Attachment Creator webservice with Domain MSP

Description

The inconsistencies described below may occur in the domain of the attachment created from Attachment Creator SOAP webservice:

1. If the attachment size is bigger than the cut-off value set in the system property glide.soapprocessor.large_field_patch_max, it will save the SOAP message as an attachment into the sys_attachment table.
In this case, the attachment file's domain will be set as user's domain, as the BR "Domain - Set Domain - Attachment" will not be triggered.

2. If the attachment size is smaller than the value set in glide.soapprocessor.large_field_patch_max, it will save the payload into ecc_queue.payload first and then convert to an attachment.
This action is done by the business rule "AttachmentCreatorSensor" and the script include "SoapAttachments". In this case the Business Rule "Domain - Set Domain - Attachment" will set this attachment's domain to the incident's domain.

Steps to Reproduce

1. Assign a user with SOAP role, i.e. acme.employee, to the TOP/ACME domain.

2. Assign an incident, i.e. INC0010096, to the TOP/ACME/ACMEBranch/ACMEBranch-child domain.

3. Create an attachment using SOAPUI for the user.

4. When the SOAPUI project is uploaded (soap_attachment_domain.xml.zip), in SOAPUI, import the project.

4.1 Run the "insert"-"Request 1" will create a small attachment (384K) which will be assigned to the domain of the incident (TOP/ACME/ACMEBranch/ACMEBranch-child).

4.2 Run the "insert"-"Request big" will create a bigger attachment (1.2M) which will be assigned to the domain of the user (TOP/ACME).

As a result, observe the owner of the incident (user in TOP/ACME/ACMEBranch/ACMEBranch-child) will not able to see those bigger attachments which are in parent domain (TOP/ACME):

Workaround

This is expected behaviour since Geneva, as using the Attachment Creator web service is no longer recommended. Use instead the REST Attachment API, which writes the attachment directly into the attachment table. This will cause the attachment to belong to the correct domain based on the user for all attachment sizes.

Ref.:

AttachmentCreator SOAP web service

Geneva Attachment API

Kingston Attachment API

Related Problem: PRB627264