[rt-users] Recursive Group Rights?

[Paul Hirose]

I'm trying to get recursive group rights, and I'm missing something :)

RT-3.8.1, mostly default settings for now.

I create Queue: Dept-A-Support-Queue, and Group: Dept-A-Support-Group.  I also create Group: Company-Support-Group.  I make User: Dept-A-Support-Person-1 and put that person in Dept-A-Support-Group.  I make User: Company-Support-Person-1 and put that person in Compnay-Support-Group.  I now make Company-Support-Group a member of Dept-A-Support-Group.  Finally, I go to Dept-A-Support-Queue and give Group rights to Dept-A-Support-Group to SeeQueue (and other stuff.)

I thought this would allow Company-Support-Person-1 rights to Dept-A-Support-Queue.  But it doesn't seem like it.  Dept-A-Support-Person-1 can indeed mess with Dept-A-Support-Queue.

CSP1 is a member of CSG.  CSG is a member of DASG.  DASG is given rights to DASQ.  But CSP1 can't modify, see, etc DASQ.  If CSG is given rights to DASQ, then indeed CSP1 can modify, see, etc DASQ.  I had hoped CSG would be given the same rights as DASG, via its membership.

DASP1 is a member of DASG.  DASG is given rights to DASQ.  DASP1 can indeed modify, see, etc DASQ.

The point being, a local departmental support person can mess only with his own queue and tickets.  A company wide support person can mess with any department's support queue (and the company wide support queue.)

I could give Global Rights to CSG, but I can't :)  There are actually a couple queues that a CSG member shouldn't have access to.  So I thought by doing the above, I wouldn't have to manually edit every queue to give CSG rights, if I just stuck CSG inside each department's group (which already has the rights needed.)

Thank you,
PH

--
Paul Hirose          : pthirose at ucdavis.edu : Sysadm Motto: rm -fr /MyLife
1034 Academic Surge  : Programmer/Analyst   : Backup Motto : rm -fr /
One Shields Avenue   : Voice (530) 752-7181 : Robot, n.: Univ. Admin
Davis, CA 95616-8770 : Fax   (530) 752-4465 : rec.pets.cat.anecdotes