Skip to page contentSkip to chat
ServiceNow support
    • Community
      Ask questions, give advice, and connect with fellow ServiceNow professionals.
      Developer
      Build, test, and deploy applications
      Documentation
      Find detailed information about ServiceNow products, apps, features, and releases.
      Impact
      Accelerate ROI and amplify your expertise.
      Learning
      Build skills with instructor-led and online training.
      Partner
      Grow your business with promotions, news, and marketing tools
      ServiceNow
      Learn about ServiceNow products & solutions.
      Store
      Download certified apps and integrations that complement ServiceNow.
      Support
      Manage your instances, access self-help, and get technical support.
LDAP Listener which runs as system user is not able to update a sys_user_group record which contains a scope protected role - Known Error
  • >
  • Knowledge Base
  • >
  • Known Error (Knowledge Base)
  • >
  • LDAP Listener which runs as system user is not able to update a sys_user_group record which contains a scope protected role
KB0830569

LDAP Listener which runs as system user is not able to update a sys_user_group record which contains a scope protected role


949 Views Last updated : Apr 8, 2024 public Copy Permalink
KB Summary by Now Assist

Description

After scope protected roles are added to groups (e.g when customers install the "Customer Service Management" plugin and assign any of the CSM roles to a group), the LDAP Listener will not longer be able to update the [sys_user_group] or its members

Steps to Reproduce

Please note this apply to all scoped protected applications. 

1. Install CSM plugin on Madrid/New York instance
2. Assign a OOB CSM role to a group (ie. sn_customerservice_agent to an existing group) that syncronises over LDAP.
3. Run "Refresh from LDAP" or initiate an LDAP Import for the group.
4. You may see "Error occured during row update" or no updates to the record or an error like this in the node logs:

2020-09-17 12:29:16 (644) LDAP Transformfec866b1db67e340f236cf831596190c SYSTEM txid=13caaab1dbdf WARNING *** WARNING *** RoleAccessHandler: User system does not have the role 'sn_templated_snip.template_snippet_reader' which is required to grant/remove 'sn_templated_snip.template_snippet_reader' under application administration, Resource: 'record/sys_user_group/write'

Workaround

Please ensure to find the specific groups that has a scoped protected role associated to them. 

As the listener runs as system, it will not be able to update the groups while they have the role associated. Ensure your administrators are aware of that. Also, please validate there is a scheduled job setup with a user that have the scoped protected roles needed and the scheduled job will execute regularly.


Related Problem: PRB1383229

The world works with ServiceNow.

Sign in for more! There's more content available only to authenticated users Sign in for more!
Did this KB article help you?
Did this KB article help you?

How would you rate your Now Support digital experience?

*

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

What can we improve? Please select all that apply.

What are we doing well? Please select all that apply.

Tell us more

*

Do you expect a response from this feedback?

  • Terms and conditions
  • Privacy statement
  • GDPR
  • Cookie policy
  • © 2025 ServiceNow. All rights reserved.