[rt-users] Question regarding group rights configuration semantics

[Kenneth Crocker]

Ole Craig,


	When you are in configuration for groups, then you are basically 
setting global rights for all other groups (depending on which ones you 
choose) to have over the group you selected initially for setting group 
rights (boy, that IS a mouthful isn't it). For example, if you go to 
configuration->groups->GL(name of the group you are setting rights 
for)->Group Rights and you grant the right to "SeeGroup" for the group 
named "Budget", then you have granted every user in the "Budget" Group 
the right to see the group "GL" on their screen when looking at groups. 
If you granted "AdminGroupMembership" to "Budget", then any user in the 
"Budget" group will be able to add/delete members of the "GL" group. 
This will apply to ANY group listed on the "Group Rights" screen that 
you grant rights to. I'm not sure I explained that in a way that is easy 
to understand, but the matrix of privileges as it applie to queues, 
groups, users, custom fields, etc is really complex. I hope this helped.

Kenn
LBNL

Ole Craig wrote:
> (3.6.0)
> 
> Dumb, basic question, if I got it wrong I don't understand how it's
> possible for my RT instance to be functional at all, but now I'm
> worried... 
> 
> If I'm in Configuration->Groups->[group name]->Group Rights, where it
> says "Modify group rights for group [group name]....
> 
> am I modifying the rights that [group name] has over each listed role or
> group in the comboxes? 
> 
> Or am I modifying the rights that each listed role or group has *over
> [group name]*?
> 
> For instance, if in that screen I see that the 'EditSavedSearches' right
> under "Everyone" is granted -- does that mean that [group name] can edit
> the saved searches that show up for the "everyone" role? Or does it mean
> that "Everyone" can edit [group name]'s saved searches?
> 
> 	Thanks,
> 		Ole
>