<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><DIV><DIV>On Aug 3, 2005, at 12:18 PM, Thomas Sibley wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">James Chamberlain wrote:</DIV> <BR><BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">I was going to approach this problem at a lower level.<SPAN class="Apple-converted-space"> </SPAN>If I've got this right, the default ACLs that RT sets up (at least for MySQL and PostgreSQL) specify that RT should be allowed to select, insert, update, and delete.<SPAN class="Apple-converted-space"> </SPAN>If instead the ACLs were modified so that RT could only select, I think that would accomplish the goal.<SPAN class="Apple-converted-space"> </SPAN>I haven't set this up yet, so I don't yet know yet how RT will handle this.<SPAN class="Apple-converted-space"> </SPAN>Perhaps that's a question for the list.<SPAN class="Apple-converted-space"> </SPAN>This technique will require two RT installations sharing one db - one internal, which has full permissions and will run rt-mailgate; and the other external, which will only be allowed to view.</DIV> <BR></BLOCKQUOTE><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">I'm not sure how RT will react to this.<SPAN class="Apple-converted-space"> </SPAN>For one, it won't be able to store session information in the database, though it will still want users to log in (unless you cut that part out).<SPAN class="Apple-converted-space"> </SPAN>I doubt it will work as expected/desired, but have a go at it and see what happens.<SPAN class="Apple-converted-space"> </SPAN>:)</DIV></BLOCKQUOTE><BR></DIV><DIV>Then perhaps it would work to give the external instance of RT full privileges on whichever tables are used for session information, but only select on all others? I'm assuming this would be the "sessions" table, possibly "Users" - any others?</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>James</DIV><DIV><FONT class="Apple-style-span" color="#0000DD"></FONT></DIV></BODY></HTML>