[rt-users] Question regarding group rights configuration semantics

[Ole Craig]

	Thanks, Kenn! That does help quite a bit. 

        The wording of the screen is ambiguous enough that if you go in
with the assumption that you're configuring this group with rights over
other objects, there's nothing that really shouts "No, it's the other
way 'round, stupid!"

        In poking some more, I think I did do it right when I set up my
initial groups 18 months ago -- but in the intervening time I'd
forgotten. :-[

        It would be Really Nice(tm) if the rights configuration screens
had some sort of explanatory text on them.

	Thanks,
		Ole


On Fri, 2007-06-15 at 11:38 -0700, Kenneth Crocker wrote:
> Ole Craig,
> 
> 
> 	When you are in configuration for groups, then you are basically 
> setting global rights for all other groups (depending on which ones you 
> choose) to have over the group you selected initially for setting group 
> rights (boy, that IS a mouthful isn't it). For example, if you go to 
> configuration->groups->GL(name of the group you are setting rights 
> for)->Group Rights and you grant the right to "SeeGroup" for the group 
> named "Budget", then you have granted every user in the "Budget" Group 
> the right to see the group "GL" on their screen when looking at groups. 
> If you granted "AdminGroupMembership" to "Budget", then any user in the 
> "Budget" group will be able to add/delete members of the "GL" group. 
> This will apply to ANY group listed on the "Group Rights" screen that 
> you grant rights to. I'm not sure I explained that in a way that is easy 
> to understand, but the matrix of privileges as it applie to queues, 
> groups, users, custom fields, etc is really complex. I hope this helped.
> 
> Kenn
> LBNL
> 
> Ole Craig wrote:
> > (3.6.0)
> > 
> > Dumb, basic question, if I got it wrong I don't understand how it's
> > possible for my RT instance to be functional at all, but now I'm
> > worried... 
> > 
> > If I'm in Configuration->Groups->[group name]->Group Rights, where it
> > says "Modify group rights for group [group name]....
> > 
> > am I modifying the rights that [group name] has over each listed role or
> > group in the comboxes? 
> > 
> > Or am I modifying the rights that each listed role or group has *over
> > [group name]*?
> > 
> > For instance, if in that screen I see that the 'EditSavedSearches' right
> > under "Everyone" is granted -- does that mean that [group name] can edit
> > the saved searches that show up for the "everyone" role? Or does it mean
> > that "Everyone" can edit [group name]'s saved searches?
> > 
> > 	Thanks,
> > 		Ole
> > 
-- 
/Ole Craig
Security Engineer
Team lead, customer support

ocraig at stillsecure.com
303-381-3824 direct
303-381-3802 support
303-381-3880 fax

www.stillsecure.com