Requester Record not populating in Ticket

Please see below (I know it is rough).  I have a Client user with a valid TDX people record when they create a ticket the link to the requester record will not work.  A symptom of this is that the Template Field in the response template does not populate as expected.

https://www.screencast.com/t/yvhTes2F

Any ideas?

Thanks, Tevis

Asked by Tevis Boulware on Thu 10/26/23 4:50 PM
Sign In to leave feedback or contribute an answer

Answer (1)

This answer has been marked as the accepted answer
Brittany Renn Thu 10/26/23 4:57 PM

Hi Tevis, 

It looks like the Requestor is being listed as Read-Only for some reason. How was that ticket created? Through a public form on the client portal, email, or something else? 

Thanks, 
Brittany Renn
TDX Support

No feedback
Through a public form. - Tevis Boulware Thu 10/26/23 4:58 PM
Can you check and see which Requestor Matching Mode is enabled on the Service? You should be able to tell by clicking Edit Service > Form tab. I'm guessing it is probably set to None and you'll want to change it to "Match using Email Address. If no requestor is found, enter requestor information as read-only text in the new ticket." Let me know if that is the case. - Brittany Renn Thu 10/26/23 5:00 PM
That was the setting, and this service is a true "public" service, open to the community. We disabled this feature due to the security risk:

Please be aware that the selected Requestor Matching Mode option may pose a security risk. If a public user has the information for an existing person in the system, they can effectively enter tickets as someone other than themselves. The system would have no indication that the ticket was not created by the requestor listed on the ticket.

How big of a risk might this be?

Thanks, Tevis - Tevis Boulware Thu 10/26/23 5:06 PM
I understand! That warning is valid in that users could submit requests with another users email address and that ticket would then have the Requestor listed as the user whose email matched an existing record. They wouldn't be able to login as someone else or really take any action, but it'd be possible to put any email in the email address field and if that matches an existing user, it will use that user as the Requestor. - Brittany Renn Fri 10/27/23 8:52 AM