Get all roles assigned to a user

Server-sideintermediateTested on Xanadu

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Retrieve all roles held by a user including group-inherited roles

Script Include

var UserRoleUtil = Class.create();
UserRoleUtil.prototype = {
    
    getAllUserRoles: function(userSysId) {
        if (gs.nil(userSysId)) {
            return [];
        }
        
        var roleSet = {};
        var roles = [];
        
        // Get direct roles from sys_user_has_role table
        var grUserRole = new GlideRecord('sys_user_has_role');
        grUserRole.addQuery('user', userSysId);
        grUserRole.query();
        
        while (grUserRole.next()) {
            var roleId = grUserRole.getValue('role');
            var roleName = grUserRole.getDisplayValue('role');
            
            if (!roleSet[roleId]) {
                roleSet[roleId] = true;
                roles.push({
                    sys_id: roleId,
                    name: roleName,
                    source: 'direct'
                });
            }
        }
        
        // Get all effective roles including group inheritance
        var userGR = new GlideRecord('sys_user');
        if (userGR.get(userSysId)) {
            var userObj = gs.getUser(userGR.getValue('user_name'));
            var effectiveRoles = userObj.getRoles();
            
            // Add any roles not already captured from direct assignment
            for (var i = 0; i < effectiveRoles.size(); i++) {
                var effectiveRoleId = effectiveRoles.get(i);
                
                if (!roleSet[effectiveRoleId]) {
                    var roleGR = new GlideRecord('sys_user_role');
                    if (roleGR.get(effectiveRoleId)) {
                        roles.push({
                            sys_id: effectiveRoleId,
                            name: roleGR.getValue('name'),
                            source: 'inherited'
                        });
                    }
                }
            }
        }
        
        return roles;
    },
    
    type: 'UserRoleUtil'
};

ServiceNow's role system has a critical blind spot that trips up most developers: the sys_user_has_role table only contains directly assigned roles, not roles inherited through group membership. A user might have full admin access through group inheritance, but querying sys_user_has_role will show nothing. You need both the table query for direct assignments and gs.getUser().getRoles() for the complete effective role set.

When to use this

Building role audit reports that need to show both direct and inherited assignments
Implementing custom access controls that need the complete role picture
User onboarding/offboarding workflows that track role assignment sources
Debugging permission issues where you need to trace role inheritance paths

When NOT to use this

Don't call this in a Business Rule that fires on user updates — you'll create infinite loops when role changes trigger user updates
Don't use this for simple role checks — use gs.hasRole() instead for better performance
Don't run this in batch operations over hundreds of users — the gs.getUser() calls will kill performance
Don't use this from client-side scripts — wrap it in a GlideAjax call instead

Key behaviors and gotchas

The sys_user_has_role table only shows direct role assignments — group-inherited roles exist only in memory
The gs.getUser() method requires a username, not a sys_id — you must look up the username first
Role inheritance calculations respect ACLs — you might see different results based on who's running the script
Inactive users still show in sys_user_has_role but gs.getUser() returns limited data for them
Domain separation affects both direct and inherited role visibility — cross-domain roles may be filtered out

⚠️

Never assume sys_user_has_role gives you the complete picture. I've seen production security bugs where developers only checked direct roles and missed users with admin access through group inheritance. Always validate against gs.getUser().getRoles() for security-sensitive operations.

Free Newsletter

Enjoying this? Get one deep-dive per week.

Join 1,000+ ServiceNow pros — scripts, GlideRecord patterns, Flow Designer techniques, and career moves. Free.

Alternative Approaches

Group membership approach

getAllRolesViaGroups: function(userSysId) {
    var roles = [];
    var roleSet = {};
    
    // Get all groups this user belongs to
    var grGroupMember = new GlideRecord('sys_user_grmember');
    grGroupMember.addQuery('user', userSysId);
    grGroupMember.query();
    
    while (grGroupMember.next()) {
        var groupId = grGroupMember.getValue('group');
        
        // Get all roles assigned to this group
        var grGroupRole = new GlideRecord('sys_group_has_role');
        grGroupRole.addQuery('group', groupId);
        grGroupRole.query();
        
        while (grGroupRole.next()) {
            var roleId = grGroupRole.getValue('role');
            if (!roleSet[roleId]) {
                roleSet[roleId] = true;
                roles.push({
                    sys_id: roleId,
                    name: grGroupRole.getDisplayValue('role'),
                    source: 'group: ' + grGroupRole.getDisplayValue('group')
                });
            }
        }
    }
    
    return roles;
}

Use this when you need to trace exactly which groups are granting specific roles.

Trade-offs: More complex and slower, but gives you the complete inheritance chain for auditing.

API Methods Used

GlideRecord.addQuery()GlideRecord.getValue()

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue