Group rights do not work

RT Users
#1

Hello,

I am having a problem in getting and rt group to see it’s queue and ticket
and ONLY it’s queue and tickets. I believe i have everything setup
correctly in the interface, which leads me to believe I may be having a
technical problem with my RT installation.

I’ll use screenshots primarily to describe the issue.

I’ve created an RT user (in the RT system only) and when he logs in this
is all he can see

[image: Inline image 1]

He is a member of a group called MMTECH. Here is how the group rights are
assigned.

[image: Inline image 5]

[image: Inline image 2]

I gave him these individual rights

[image: Inline image 3]

And yet he can only see the interface shot in the first screenshot I
include. I have no idea why and I very much need to correct this situation
so that a new group can start using RT.

Again, they need to see their queue and tickets and ONLY their queue and
tickets. If I give the user the Let this user be granted rights
(Privileged) the members can see ALL queues and tickets which si not what
we want.

PLEASE help as I really need to solve this problem.

Thank you
Tim

GPG me!!

gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

#2

Hello,

I am having a problem in getting and rt group to see it’s queue and
ticket and ONLY it’s queue and tickets. I believe i have everything
setup correctly in the interface, which leads me to believe I may be
having a technical problem with my RT installation.

I’ll use screenshots primarily to describe the issue.

I’ve created an RT user (in the RT system only) and when he logs in
this is all he can see

He is a member of a group called MMTECH. Here is how the group rights
are assigned.

I gave him these individual rightsAnd yet he can only see the
interface shot in the first screenshot I include. I have no idea why
and I very much need to correct this situation so that a new group can
start using RT.

Again, they need to see their queue and tickets and ONLY their queue
and tickets. If I give the user the Let this user be granted rights
(Privileged) the members can see ALL queues and tickets which si not
what we want.

PLEASE help as I really need to solve this problem.

Try adding group rights to queues… adding group rights to a group
for a member only gives them rights to that group, not to any queue. You
need to go to a queue and go to Group Rights in the queue and assign
rights to the MMTECH group in that queue…

(Click Tools, Configuration, Queues, (Name of Group you want to add
group rights to), Group Rights, type in MMTECH in the Add Group area,
and assign rights.)

Make sense?
Best,
–Glenn

Glenn E. Sieb
System Administrator
+1 201 809-4958

eFashionSolutions
80 Enterprise Avenue South
Secaucus, NJ 07094

#3

Hi Glenn,

Thanks for your input. However no progress has been made tho I followed
your advice to the letter.

This is how I have the group setup.

[image: Inline image 1]

And this is all the mmtest user (member of the mmtech group) can see

[image: Inline image 2]

I’m simply at a loss here as to what could be going wrong.

Thanks again for your input.
TimOn Wed, Sep 26, 2012 at 2:47 PM, Glenn E. Sieb gsieb@efashionsolutions.comwrote:

On 09/26/2012 02:32 PM, Tim Dunphy wrote:

Hello,

I am having a problem in getting and rt group to see it’s queue and
ticket and ONLY it’s queue and tickets. I believe i have everything setup
correctly in the interface, which leads me to believe I may be having a
technical problem with my RT installation.

I’ll use screenshots primarily to describe the issue.

I’ve created an RT user (in the RT system only) and when he logs in this
is all he can see

He is a member of a group called MMTECH. Here is how the group rights are
assigned.

I gave him these individual rightsAnd yet he can only see the interface
shot in the first screenshot I include. I have no idea why and I very much
need to correct this situation so that a new group can start using RT.

Again, they need to see their queue and tickets and ONLY their queue and
tickets. If I give the user the Let this user be granted rights
(Privileged) the members can see ALL queues and tickets which si not what
we want.

PLEASE help as I really need to solve this problem.

Try adding group rights to queues… adding group rights to a group for
a member only gives them rights to that group, not to any queue. You need
to go to a queue and go to Group Rights in the queue and assign rights to
the MMTECH group in that queue…

(Click Tools, Configuration, Queues, (Name of Group you want to add group
rights to), Group Rights, type in MMTECH in the Add Group area, and assign
rights.)

Make sense?
Best,
–Glenn

–
Glenn E. Sieb
System Administrator
+1 201 809-4958

eFashionSolutions
80 Enterprise Avenue South
Secaucus, NJ 07094

GPG me!!

gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

#4

Hi TIm,

Is the mmtech user now set up as privileged? None of the rights changes you apply will take effect on non-privileged users.

Regards

Chris O’Kelly
Web Administrator

Minecorp Australia
37 Murdoch Circuit
Acacia Ridge QLD 4110
minecorp.com.auhttp://www.minecorp.com.au

P: 07 3723 1000
M: 0450 586 190
E: Chris.okelly@minecorp.com.aumailto:Chris.okelly@minecorp.com.au
S: chris.okelly.mvshttp://skype.com

[http://oi46.tinypic.com/mw8nbd.jpg]From: rt-users-bounces@lists.bestpractical.com [mailto:rt-users-bounces@lists.bestpractical.com] On Behalf Of Tim Dunphy
Sent: Thursday, 27 September 2012 7:29 AM
To: Glenn E. Sieb
Cc: rt-users@lists.bestpractical.com
Subject: Re: [rt-users] group rights do not work

Hi Glenn,

Thanks for your input. However no progress has been made tho I followed your advice to the letter.

This is how I have the group setup.

[cid:image001.png@01CD9C85.F392CCC0]

And this is all the mmtest user (member of the mmtech group) can see

[cid:image002.png@01CD9C85.F392CCC0]

I’m simply at a loss here as to what could be going wrong.

Thanks again for your input.
Tim

#5

Hi Glenn,

Thanks for your input. However no progress has been made tho I
followed your advice to the letter.

Silly question…

Can you go to the mmtech user and click “Memberships”?

What’s the output of that?

Best,
–Glenn

Glenn E. Sieb
System Administrator
+1 201 809-4958

eFashionSolutions
80 Enterprise Avenue South
Secaucus, NJ 07094

#6

Hey guys,

Thanks and I genuinely appreciate your replies

Hi TIm,

Is the mmtech user now set up as privileged? None of the rights changes
you apply will take effect on non-privileged users.****

No the mmtest user is not setup as privileged. This is is intentional.
Because unless I’m mistaken (and I’ll be the first one to admit I might be)
a privileged user will see all queues in addition to their own. The goal
here is to get a non privileged user to see only their queue and also I’d
like it if they could see their dashboard as well. But let me ask a stupid
question if I may. Is this all that an unprivileged user is supposed to
see? I thought even an unprivileged user given the appropriate rights
should be able to see elements like ‘10 newest tickets I own’, ‘My
reminders’ , ‘quick ticket creation’ and etc. But instead this is all the
mmtest user can see:

[image: Inline image 1]

Silly question…

Can you go to the mmtech user and click “Memberships”?

What’s the output of that?

If I go to the mmtest user and click memberships this is what I see:

[image: Inline image 3]

And these are the group rights for the mmtech group

[image: Inline image 4]

So in short I"m hoping to give the mmtest user access to the mmtech queue
and see a few more visual elements than what is displayed in the first
screenshot I display. Ideally I’d want them to have access to their
Dashboard as well.

Thanks once again for your input
TimOn Wed, Sep 26, 2012 at 7:03 PM, Glenn E. Sieb gsieb@efashionsolutions.comwrote:

On 09/26/2012 05:28 PM, Tim Dunphy wrote:

Hi Glenn,

Thanks for your input. However no progress has been made tho I followed
your advice to the letter.

Silly question…

Can you go to the mmtech user and click “Memberships”?

What’s the output of that?

Best,
–Glenn

–
Glenn E. Sieb
System Administrator
+1 201 809-4958

eFashionSolutions
80 Enterprise Avenue South
Secaucus, NJ 07094

GPG me!!

gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

#7

No the mmtest user is not setup as privileged. This is is intentional. Because unless I’m
mistaken (and I’ll be the first one to admit I might be) a privileged user will see all queues
in addition to their own.

You’ve misunderstood Privileged vs Unprivileged.
Privileged users have access to the full RT UI, Unprivileged users
will always be redirected to the SelfService UI.

Privileged users do not “see everything” in RT. They see only what
they are assigned rights for (otherwise how could you limit Privileged
staff users to only working in a single Queue).

If you want a user to see RT At a Glance, they must be Privileged.

-kevin

#8

You’ve misunderstood Privileged vs Unprivileged.
Privileged users have access to the full RT UI, Unprivileged users
will always be redirected to the SelfService UI.

Privileged users do not “see everything” in RT. They see only what
they are assigned rights for (otherwise how could you limit Privileged
staff users to only working in a single Queue).

If you want a user to see RT At a Glance, they must be Privileged.

Great! Thanks for the clarification. Really the only issue I want to
address is that when the mmtest user sees the full UI the ‘10 newest
unowned tickets’ displays tickets from all queues. That’s why I thought
that the user being privileged gave a user access to ‘everything’.

[image: Inline image 1]

Sorry if this is a rather basic question, but how would I get the ‘mmtest’
user (who is now privileged) to see only tickets from the MMTECH queue and
not see any tickets at all from the Ops queue in their ‘10 Newest Unowned
Tickets’?

Lastly in ‘Queues I administer’ how can I limit the members of the mmtech
group to only administer that queue?

[image: Inline image 2]

thanks
TimOn Thu, Sep 27, 2012 at 12:14 PM, Kevin Falcone falcone@bestpractical.comwrote:

On Thu, Sep 27, 2012 at 11:57:55AM -0400, Tim Dunphy wrote:

No the mmtest user is not setup as privileged. This is is
intentional. Because unless I’m
mistaken (and I’ll be the first one to admit I might be) a privileged
user will see all queues
in addition to their own.

You’ve misunderstood Privileged vs Unprivileged.
Privileged users have access to the full RT UI, Unprivileged users
will always be redirected to the SelfService UI.

Privileged users do not “see everything” in RT. They see only what
they are assigned rights for (otherwise how could you limit Privileged
staff users to only working in a single Queue).

If you want a user to see RT At a Glance, they must be Privileged.

-kevin

The goal here is to get a non privileged user to see only their
queue and also I’d like it if they could see their dashboard as well.
But let me ask a stupid
question if I may. Is this all that an unprivileged user is supposed
to see? I thought even an
unprivileged user given the appropriate rights should be able to see
elements like ‘10 newest
tickets I own’, ‘My reminders’ , ‘quick ticket creation’ and etc. But
instead this is all the
mmtest user can see:

Final RT training for 2012 in Atlanta, GA - October 23 & 24
Training — Best Practical Solutions

We’re hiring! http://bestpractical.com/jobs

GPG me!!

gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

#9

Hi,

I think it sounds as though there are other rights set up beside this one, possibly globally configured ones. I can’t say for sure without seeing your setup, but here’s the cases I can think of that would cause this rights scenario:

-In Tools>Configuration>Global>User Rights : MMTECH has been assigned the SeeQueue (View Queue) right.
-In Tools>Configuration>Global>Group Rights : MMTECH has been assigned the SeeQueue (View Queue) right.
-In Tools>Configuration>Global>Group Rights : MMTECH has been assigned the SeeQueue (View Queue) right.
-In Tools>Configuration>Global>Group Rights : Everyone has been assigned the SeeQueue (View Queue) right.
-In Tools>Configuration>Global>Group Rights : Privileged has been assigned the SeeQueue (View Queue) right.
-In Tools>Configuration>Global>Group Rights : AdminCC has been assigned the SeeQueue (View Queue) right, and the MMTECH user is set up as AdminCC on the other queues (unlikely?).
-In Tools>Configuration>Queues>[The other queues]>[User|Group] Rights : MMTECH (user or group) has been assigned the SeeQueue (View Queue) right (unlikely?).

Essentially, for a given queue, one can see it given that :
User is Privileged, and [
User has SeeQueue right in that queue’s User Rights section or
User is in a group/role that has been assigned the SeeQueue right in that queue’s Group Rights or
User has SeeQueue right in global configuration User Rights or
User is in a group/role that has been assigned the SeeQueue right in global configuration or
User (Or a group they are in) has been assigned the SuperUser right in global configuration
]

I think it’s most likely you’ve made the same mistake I did starting out with RT rights - I thought a user first needed the global SeeQueue right for the queue-specific SeeQueue rights to take effect, so I gave Everyone SeeQueue globally then planned to also give it in specific queues for particular groups. Really though a user just needs the right anywhere up the line from their current context.

Regards

Chris O’Kelly
Web Administrator

Minecorp Australia
37 Murdoch Circuit
Acacia Ridge QLD 4110
minecorp.com.auhttp://www.minecorp.com.au

P: 07 3723 1000
M: 0450 586 190
E: Chris.okelly@minecorp.com.aumailto:Chris.okelly@minecorp.com.au
S: chris.okelly.mvshttp://skype.com

[http://i50.tinypic.com/53qp8j.gif]From: rt-users-bounces@lists.bestpractical.com [mailto:rt-users-bounces@lists.bestpractical.com] On Behalf Of Tim Dunphy
Sent: Friday, 28 September 2012 2:33 AM
To: rt-users@lists.bestpractical.com
Subject: Re: [rt-users] group rights do not work

You’ve misunderstood Privileged vs Unprivileged.
Privileged users have access to the full RT UI, Unprivileged users
will always be redirected to the SelfService UI.

Privileged users do not “see everything” in RT. They see only what
they are assigned rights for (otherwise how could you limit Privileged
staff users to only working in a single Queue).

If you want a user to see RT At a Glance, they must be Privileged.

Great! Thanks for the clarification. Really the only issue I want to address is that when the mmtest user sees the full UI the ‘10 newest unowned tickets’ displays tickets from all queues. That’s why I thought that the user being privileged gave a user access to ‘everything’.

[cid:image001.png@01CD9D52.399A1210]

Sorry if this is a rather basic question, but how would I get the ‘mmtest’ user (who is now privileged) to see only tickets from the MMTECH queue and not see any tickets at all from the Ops queue in their ‘10 Newest Unowned Tickets’?

Lastly in ‘Queues I administer’ how can I limit the members of the mmtech group to only administer that queue?

[cid:image002.png@01CD9D52.399A1210]

thanks
Tim

No the mmtest user is not setup as privileged. This is is intentional. Because unless I’m
mistaken (and I’ll be the first one to admit I might be) a privileged user will see all queues
in addition to their own.
You’ve misunderstood Privileged vs Unprivileged.
Privileged users have access to the full RT UI, Unprivileged users
will always be redirected to the SelfService UI.

Privileged users do not “see everything” in RT. They see only what
they are assigned rights for (otherwise how could you limit Privileged
staff users to only working in a single Queue).

If you want a user to see RT At a Glance, they must be Privileged.

-kevin

The goal here is to get a non privileged user to see only their
queue and also I’d like it if they could see their dashboard as well. But let me ask a stupid
question if I may. Is this all that an unprivileged user is supposed to see? I thought even an
unprivileged user given the appropriate rights should be able to see elements like ‘10 newest
tickets I own’, ‘My reminders’ , ‘quick ticket creation’ and etc. But instead this is all the
mmtest user can see:

Final RT training for 2012 in Atlanta, GA - October 23 & 24
Training — Best Practical Solutions

We’re hiring! http://bestpractical.com/jobs

GPG me!!

gpg --keyserver pool.sks-keyservers.nethttp://pool.sks-keyservers.net --recv-keys F186197B