Josh,<br><br>You can do what you want.<br>By watching this list, I've noticed there are hundreds of installations that do things differently. Some let the Requestors modify their own tickets, etc.<br>What I put down was just a suggestion for you and it will most likely not apply for others.<br>
<br>Kenn<br>LBNL<br><br><div class="gmail_quote">On Mon, Oct 25, 2010 at 5:44 AM, Josh Narins <span dir="ltr"><<a href="mailto:jnarins@seniorbridge.com">jnarins@seniorbridge.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);">Ken, thanks for your time. </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);">While the below looks really good both in the sense that it
appears to be consistent and in the sense you've laid it all out for me, could
I get someone else's opinion on it? </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);">Ruslan or Jesse perhaps?</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);">If it all looks good, then maybe (it could get posted|I could
post it) to the wiki as an example?</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);">Thanks,</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);">Josh</span></p><div class="im">
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);"> </span></p>
<br><br><font face="Verdana" size="2"><b>Josh Narins</b></font><br><br><font face="Verdana" size="1">Director of Application Development<br>SeniorBridge<br>845 Third Ave<br>
7th Floor<br>New York, NY 10022 <br>
Tel: (212) 994-6194 <br>
Fax: (212) 994-4260 <br>
Mobile:
(917) 488-6248<br><a href="mailto:jnarins@seniorbridge.com" target="_blank">jnarins@seniorbridge.com</a><br><a href="http://www.seniorbridge.com/" target="_blank">seniorbridge.com</a></font><br><br><img src="" alt="SeniorBridge" align="baseline" border="0" hspace="0"></div>
<div style="border-width: medium medium medium 1.5pt; border-style: none none none solid; border-color: -moz-use-text-color -moz-use-text-color -moz-use-text-color blue; padding: 0in 0in 0in 4pt;">
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; padding: 3pt 0in 0in;">
<p class="MsoNormal"><b><span style="font-size: 10pt;">From:</span></b><span style="font-size: 10pt;">
<a href="mailto:rt-users-bounces@lists.bestpractical.com" target="_blank">rt-users-bounces@lists.bestpractical.com</a>
[mailto:<a href="mailto:rt-users-bounces@lists.bestpractical.com" target="_blank">rt-users-bounces@lists.bestpractical.com</a>] <b>On Behalf Of </b>Kenneth
Crocker<br>
<b>Sent:</b> Friday, October 22, 2010 12:50 PM<br>
<b>To:</b> <a href="mailto:rt-users@lists.bestpractical.com" target="_blank">rt-users@lists.bestpractical.com</a><br>
<b>Subject:</b> Re: [rt-users] General permissions question</span></p>
</div>
</div><div><div></div><div class="h5">
<p class="MsoNormal"> </p>
<p class="MsoNormal" style="margin-bottom: 12pt;">Josh,<br>
<br>
We never grant rights to individual users, too much maintenance. I agree with
Jesse (DUH!) to create a SuperUSer Group like "System Admins", then
another called "Technical Support". I'd set rights as follows:<br>
<br>
Global System Rights:</p>
<ul type="disc">
<li class="MsoNormal">Privileged:</li>
</ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">CreateOwnDashboard</li>
<li class="MsoNormal">CreateSavedSearch</li>
<li class="MsoNormal">DeleteOwnDashboard</li>
<li class="MsoNormal">EditSavedSearch</li>
<li class="MsoNormal">ForwardMessage</li>
<li class="MsoNormal">LoadSavedSearch</li>
<li class="MsoNormal">ModifyOwnDashboard</li>
<li class="MsoNormal">ModifySelf</li>
<li class="MsoNormal">SeeOwnDashboard</li>
<li class="MsoNormal">* SeeQueue (<i>you might want this only at
a "Queue" level</i>)</li>
<li class="MsoNormal">ShowSavedSearch</li>
<li class="MsoNormal">* ShowTicket (<i>you might want this only
for "Roles" and the "support" group</i>)</li>
<li class="MsoNormal">SubscribeDashboard</li>
<li class="MsoNormal">Watch</li>
</ul>
</ul>
<p class="MsoNormal">This set will allow all users rights to their own Searches,
Searches saved for groups they are in & Dashboards set up subscriptions for
any Dashboard they have access to & modify themselves & add watchers to
tickets they are watchers on (basically, add Cc's)</p>
<ul type="disc">
<li class="MsoNormal">Everyone:</li>
</ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">ReplyToTicket</li>
<li class="MsoNormal">CreateTicket</li>
</ul>
</ul>
<p class="MsoNormal" style="margin-bottom: 12pt;">This allows anyone to create a
ticket and reply to email if sent to them from RT. If you have some form of
externalAuth going on, that will keep the spam out.</p>
<ul type="disc">
<li class="MsoNormal">Roles:</li>
</ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">Owner;</li>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<ul type="square">
<li class="MsoNormal">ModifyTicket (a no brainer)</li>
<li class="MsoNormal">* SeeQueue & ShowTicket Comments, etc
if not by group</li>
</ul>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">AdminCc (<i>we use AdminCc like a
"Queue Manager</i>);</li>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<ul type="square">
<li class="MsoNormal">AdminUsers (<i>Sys Admin only?</i>)</li>
<li class="MsoNormal">AdminCustomFields (<i>Sys Admin only?</i>)</li>
<li class="MsoNormal">AssignCustomFields (<i>we don't want just
anyone messing with these</i>)</li>
<li class="MsoNormal">ModifyACL (<i>you may want to keep this at
the "Queue" level or not at all and just let
"SuperUsers" do it</i>)</li>
<li class="MsoNormal">ModifyOwnMembership</li>
<li class="MsoNormal">ModifyQueueWatchers (<i>you may want to
keep this at the "Queue" level or not at all and just let
"SuperUsers" do it</i>)</li>
<li class="MsoNormal">ModifyScrips (<i>you may want to keep this
at the "Queue" level or not at all and just let
"SuperUsers" do it</i>)</li>
<li class="MsoNormal">ModifyTemplate (<i>you may want to keep
this at the "Queue" level or not at all and just let
"SuperUsers" do it</i>)</li>
<li class="MsoNormal">ShowACL (<i>you may want to keep this at
the "Queue" level or not at all and just for
"SuperUsers"</i>)</li>
<li class="MsoNormal">SeeCustomFields (<i>ditto</i>)</li>
<li class="MsoNormal">SeeGroup</li>
<li class="MsoNormal">* SeeQueue & ShowTicket Comments, etc
if not by group (<i>SuperUser</i>)</li>
<li class="MsoNormal">ShowConfigTab (<i>Sys Admin only?</i>)</li>
<li class="MsoNormal">ShowScrips (<i>Sys Admin only?</i>)</li>
<li class="MsoNormal">ShowTemplate (<i>Sys Admin only?</i>)</li>
<li class="MsoNormal">StealTicket (<i>you may want to keep this
at the "Queue" level or let Support group do it</i>)</li>
<li class="MsoNormal">WatchAsAdminCc</li>
<li class="MsoNormal"><i>You might want to put some of these
rights at the Queue level</i></li>
</ul>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">Cc;</li>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<ul type="square">
<li class="MsoNormal">SeeQueue (<i>if not given to
"Privileged"</i>)</li>
<li class="MsoNormal">ShowTicket (<i>if not given to "Privileged"</i>)</li>
</ul>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">Requestor</li>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<ul type="square">
<li class="MsoNormal">SeeQueue (<i>if not given to
"Privileged" or Support Group</i>)</li>
<li class="MsoNormal">ShowTicket (<i>if not given to
"Privileged" or Support Group</i>)</li>
</ul>
</ul>
</ul>
<p class="MsoNormal" style="margin-bottom: 12pt;">
Since your "Users" that create tickets will only use email, these two
rights above would allow them to see ONLY their tickets if they were to ever
sign into the WebUI.</p>
<ul type="disc">
<li class="MsoNormal">User-Defined Groups:</li>
</ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">SystemAdmin;</li>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<ul type="square">
<li class="MsoNormal">SuperUser</li>
</ul>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">Technical-Support (you may want to keep
some of these rights for this group at the "Queue" level)</li>
</ul>
</ul>
<ul type="disc">
<ul type="circle">
<ul type="square">
<li class="MsoNormal">CommentOnTicket</li>
<li class="MsoNormal">DeleteTicket</li>
<li class="MsoNormal">ModifyCustomField (may want this at the
"Queue" level)</li>
<li class="MsoNormal">ModifyTicket (<b><i>ONLY</i></b><i> if you
want members of the group to be able to modify <b>someone else's ticket</b></i>
- Owners already have this right)</li>
<li class="MsoNormal">OwnTicket</li>
<li class="MsoNormal">SeeCustomField</li>
<li class="MsoNormal">ShowOutgoingEmail</li>
<li class="MsoNormal">ShowTicket</li>
<li class="MsoNormal">ShowTicketComments</li>
<li class="MsoNormal">StealTicket (<i>you may want to keep this
at the "Queue" level</i>)</li>
<li class="MsoNormal">TakeTicket</li>
</ul>
</ul>
</ul>
<p class="MsoNormal" style="margin-bottom: 12pt;"><br>
Well, anyway, I'm sure you can get the gist of this. Hope this helps.<br>
<br>
Kenn<br>
LBNL</p>
</div></div><div><div><div></div><div class="h5">
<p class="MsoNormal">On Fri, Oct 22, 2010 at 6:34 AM, Josh Narins <<a href="mailto:jnarins@seniorbridge.com" target="_blank">jnarins@seniorbridge.com</a>> wrote:</p>
</div></div><div><div><div></div><div class="h5">
<div>
<p class="MsoNormal">I
have three classes of users, I'm wondering if my privileges/groups setup is
what RT intends.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Class
1: Administrators. These three people can do anything.</p>
<p class="MsoNormal">Class
2: People who log into RT and own and resolve tickets. Each is only going to be
working with 1-3 queues out of 10-15 queues total.</p>
<p class="MsoNormal">Class
3: People who create tickets via email and don't need to do anything but reply
via email.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Right
now I'm thinking class 1 and class 2 should be "privileged" users,
and by AdminCCs on the particular queues they are interested in. In addition,
the three superusers will have, as a User Right, the "Super User"
privilege.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Class
3 won't be users which are seen via Configuration->Users. I still haven't
figured out if they count as "Everybody" or "Unprivileged."
I'd like them to be able to view any ticket (although I suspect they will
rarely use such a power) so I'm giving them ShowTicket and ShowComment and a
few other minor privileges.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Does
that sound about right?</p>
</div>
</div></div><p class="MsoNormal" style="margin-bottom: 12pt;"></p><div><div></div><div class="h5"><br>
<br>
<b><span style="font-size: 10pt;">Josh Narins</span></b><br>
<br>
<span style="font-size: 7.5pt;">Director of
Application Development<br>
SeniorBridge<br>
845 Third Ave<br>
7th Floor<br>
New York, NY 10022 <br>
Tel: (212) 994-6194 <br>
Fax: (212) 994-4260 <br>
Mobile: (917) 488-6248<br>
<a href="mailto:jnarins@seniorbridge.com" target="_blank">jnarins@seniorbridge.com</a><br>
<a href="http://www.seniorbridge.com/" target="_blank">seniorbridge.com</a></span><br>
<br>
</div></div><b>Error! Filename not specified.</b><div class="im">
<div class="MsoNormal" style="text-align: center;" align="center">
<hr align="center" size="2" width="100%">
</div>
<p class="MsoNormal"><b><span style="font-size: 7.5pt;">SeniorBridge
Statement of Confidentiality:</span></b><span style="font-size: 7.5pt;"> The contents of this email message are
intended for the exclusive use of the addressee(s) and may contain confidential
or privileged information. Any dissemination, distribution or copying of this
email by an unintended or mistaken recipient is strictly prohibited. In said
event, kindly reply to the sender and destroy all entries of this message and
any attachments from your system. Thank you.</span></p>
</div></div>
</div>
<p class="MsoNormal"> </p>
</div>
</div>
</div>
</blockquote></div><br>