<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EstiloCorreo17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ES" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">We have been using RT for a few years. In our current RT setup (version 4.2.2), for every one of our customers we create a ticket queue and a user group. Then, in that user group, we grant rights for that specific queue
to enable our customer users to: ‘CreateTicket’, ‘ReplyToTicket’, ‘SeeQueue’ and ‘ShowTicket’. Customer users belonging to these groups remain as unprivileged users. We have separate user groups for our own staff (staff users are privileged).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Our aim is mainly to prevent a group of customers having visibility of other customer groups tickets and, also, for easier management of scrips, etc .
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Additionally – and this is important -, we rely on the REST API to provide customers with ticket lists, searches and integration with some of our services through our web portal. As an effect of that, customers never
get to interact with the RT gui.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Now, what we would need to implement is a more fine visibility configuration: More concretely, SOME of our customer users (‘restricted’ users) should ONLY be able to see those tickets in which they have the roles ‘cc’
or ‘requestor’.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">And at the same time, when they perform a search through the REST API, only the tickets for which they are requestor or cc should be returned (this one is important).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">To do so, my approach was: <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">While now we create one single group for every queue, create two groups instead: one with restricted rights and another with the rights we have been usually granting the users with.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The ‘restricted’ user group would have no ‘ShowTicket’ right; as a result, their searches would return empty. But, that combined with having the right ‘ShowTicket’ granted to the requestor and cc roles, I guessed that
would enable users to see the tickets for which they are requestor/cc, and get ONLY these tickets returned on their searches through REST API.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The problem is that, although I have tried quite a few tweaks around this on devel env (configuring customer users as privileged, for instance), I cannot get this behavior to work.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The result is that, if I grant ‘ShowTicket’ right to the ‘restricted’ user group, they see ALL the tickets in the queue; if I don’t, they see none (same goes for ticket search results). For some reason, its like its ignoring
the rights I had expected to be granted to the user via the roles ‘requestor’ and ‘cc’ (as I already mentioned, these roles DO have ‘ShowTicket’ right).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Indeed, I really feel to be missing something here.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">In the mean time, I have also started to explore the possibility of having to add a custom right for this behavior. So following the info I found at the RT wiki, I have already defined a ‘SeeOwnTickets’ right in the Queue_Local.pm
file. <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">But in the scenario of having to solve this via this solution, I would really appreciate some guidance on in which parts of RT code should I add the auth for this (considering our users only interact via the REST API).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I have already spent some time working on this; any help/guidance would be certainly appreciated.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks in advance,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Oriol Soriano.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">PS: Yes, I have read <a href="http://requesttracker.wikia.com/wiki/Rights">
http://requesttracker.wikia.com/wiki/Rights</a> and other areas of the wiki about this topic<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">PS2: I have also searched for this on the user list. Although I did find some answers and tried a few suggestions, I was not able to fully get my desired config to work.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>