Rights for create ticket in queue drop down

Hi there;

What rights should be granted to users on queues so these queues are
visible from the New Ticket in Drop down …
and also from the Queue drop down in the Basics section …
What I want is for some users to be able to create tickets and move
tickets to a particular queue, however they should n’t see the ticket
listing or search in any of these queues (ie the SeeQueue right shows
more that I would like) …
Any pointers will be appreciated …

Roy

Roy,

We are getting ready to move to RT 3.6.4 and are testing just about 

everything (we believe in heavy regression testing as well as for the
new stuff) and have learned a few new things about privileges. the
"SeeQueue" right basically lets a person create a ticket in that Queue
(via drop-down if they also have the “CreateTicket” right for that
Queue). The “ShowTicket” rights seems to be related to a user finding
tickets via Search/Query. For us, we allow some users to “SeeQueue” and
"CreateTicket" so they can create tickets but they cannot find the
tickets individually when in the web. Together, they allow a person to
create and look at the tickets. We give those rights at the Role
"Requestor" level per Queue (different Queue’s want different levels of
visibility for their users). “ShowComments”, “CommentOnTicket”, and
"ShowOutgoingEmail" are rights we reserve for our support groups along
with “ModifyTickets”, etc. (BTW, the “CommentOnTicket” is superfluous if
the “ModifyTicket” is granted). Hope this helps.

Kenn
LBNL

Roy El-Hames wrote:

Kenn;
Thanks for this , a couple of questions:
If you have granted your users the SeeQueue right how are you stopping
them from seeing the ticket listings within a queue???
Its interesting your point about CommentOnTicket right , are you saying
if someone have ModifyTicket they can Comment on a ticket … I think
this is broken, because I am sure you want some users (like customers)
to modify a ticket (change status etc ) but not add / see comments?

Roy

Kenneth Crocker wrote:

Roy El-Hames wrote:

Kenn;
Thanks for this , a couple of questions:
If you have granted your users the SeeQueue right how are you stopping
them from seeing the ticket listings within a queue???
Its interesting your point about CommentOnTicket right , are you
saying if someone have ModifyTicket they can Comment on a ticket … I
think this is broken, because I am sure you want some users (like
customers) to modify a ticket (change status etc ) but not add / see
comments?

Roy

Hey Roy,

Couple of things, there a good document on the wiki about this;

http://wiki.bestpractical.com/view/Rights

Also you would find the ‘RT Essentials’ book quite helpful for setting
user permissions.

SeeQueue just shows the Queue, not the contents of said Queue. Without
this the actor wouldn’t have the rights to access the queue to get a
listing of tickets. Only tickets that the actor has ‘ShowTicket’
privilege on will show up. So if you only wanted Requestors to be able
to have this privilege, you would take ‘ShowTicket’ away from ‘Everyone’
and make sure that ‘Requestors’ have it.

As for the ModifyTicket / Comment, this is due to the nature of how that
information is handled. Correspondence, Comments, Status, etc are all
part of the Ticket. ModifyTicket does just that, and allows for changes
over all of these things - it is kind of a catch all designed to
administrators. If you wanted clients to be able to change the status
of their tickets (see note below), you would have to add a new
privilege. Extending RT in this direction wouldn’t be too bad.

However, allowing clients to set the ticket status doesn’t seem like
that great of a deal to me. If a ticket is closed and someone adds
another correspondence to it, the ticket becomes open again. I believe
this is also the case for stalled tickets. So a client can change the
status back to open if action still needs to be taken. Really the only
case is if the client wants to set a ticket to stalled or closed - this
might not be what you want, as a client could errantly change the status
of a ticket, and it could easily fall through the cracks…

.r’

Roy,

To answer your first question; I do NOT give them the "ShowTicket" 

right. Without that right, they will not see any ticket in a queue. The
second question; “ModifyTicket” as a right INCLUDES the right to comment
on a ticket. This allows you to grant users the right to comment on a
ticket but not change anything else on the ticket. We do not let
users/customer modify tickets. User’s/customers make the request, reply
on E_mail, make comments, but all other work and status changes, etc. is
done by the support staff, who, as a group, are allowed to own tickets.
We do not grant ANY of these privileges on a global basis, but on a
Queue by Queue basis as some Quyeue may not want their customers to even
see or make comments. Hope this helps.

Kenn
LBNL

Roy El-Hames wrote:

Kenn;
Thanks for this , a couple of questions:
If you have granted your users the SeeQueue right how are you stopping
them from seeing the ticket listings within a queue???
only ShowTicket right allows you to see a ticket. For example user has
SeeQueue and CreateTicket right, but has no ShowTicket, it’s a valid
setup. User can create ticket, but he get “you can not see newly
created ticket”. Role is good way (only way) to grant conditional
rights, for example user has right X only if he’s a requestor.

Its interesting your point about CommentOnTicket right , are you saying
if someone have ModifyTicket they can Comment on a ticket … I think
this is broken, because I am sure you want some users (like customers)
to modify a ticket (change status etc ) but not add / see comments?
Adding more rights make things more complicated we’re trying to balance.

Roy

Kenneth Crocker wrote:

Roy,

We are getting ready to move to RT 3.6.4 and are testing just

about everything (we believe in heavy regression testing as well as
for the new stuff) and have learned a few new things about privileges.
the “SeeQueue” right basically lets a person create a ticket in that
Queue (via drop-down if they also have the “CreateTicket” right for
that Queue). The “ShowTicket” rights seems to be related to a user
finding tickets via Search/Query. For us, we allow some users to
“SeeQueue” and “CreateTicket” so they can create tickets but they
cannot find the tickets individually when in the web. Together, they
allow a person to create and look at the tickets. We give those rights
at the Role “Requestor” level per Queue (different Queue’s want
different levels of visibility for their users). “ShowComments”,
“CommentOnTicket”, and “ShowOutgoingEmail” are rights we reserve for
our support groups along with “ModifyTickets”, etc. (BTW, the
“CommentOnTicket” is superfluous if the “ModifyTicket” is granted).
Hope this helps.

Kenn
LBNL

Roy El-Hames wrote:

Hi there;

What rights should be granted to users on queues so these queues are
visible from the New Ticket in Drop down …
and also from the Queue drop down in the Basics section …
What I want is for some users to be able to create tickets and move
tickets to a particular queue, however they should n’t see the ticket
listing or search in any of these queues (ie the SeeQueue right shows
more that I would like) …
Any pointers will be appreciated …

Roy


The rt-users Archives

Community help: http://wiki.bestpractical.com
Commercial support: sales@bestpractical.com

Discover RT’s hidden secrets with RT Essentials from O’Reilly Media.
Buy a copy at http://rtbook.bestpractical.com


The rt-users Archives

Community help: http://wiki.bestpractical.com
Commercial support: sales@bestpractical.com

Discover RT’s hidden secrets with RT Essentials from O’Reilly Media.
Buy a copy at http://rtbook.bestpractical.com

Best regards, Ruslan.

Thank you all for you responses … I need to pay more attention to what
rights are assigned on my system …
Ruslan; I am not sure if I would agree with you about the
CommentOnTicket right, there is a big difference between adding/
therefore seeing Comments and changing the status of a ticket …
Thanks once more.
Roy
Ruslan Zakirov wrote:> On 7/26/07, Roy El-Hames rfh@pipex.net wrote:

Kenn;
Thanks for this , a couple of questions:
If you have granted your users the SeeQueue right how are you stopping
them from seeing the ticket listings within a queue???
only ShowTicket right allows you to see a ticket. For example user has
SeeQueue and CreateTicket right, but has no ShowTicket, it’s a valid
setup. User can create ticket, but he get “you can not see newly
created ticket”. Role is good way (only way) to grant conditional
rights, for example user has right X only if he’s a requestor.

Its interesting your point about CommentOnTicket right , are you saying
if someone have ModifyTicket they can Comment on a ticket … I think
this is broken, because I am sure you want some users (like customers)
to modify a ticket (change status etc ) but not add / see comments?
Adding more rights make things more complicated we’re trying to balance.

Roy

Kenneth Crocker wrote:

Roy,

We are getting ready to move to RT 3.6.4 and are testing just

about everything (we believe in heavy regression testing as well as
for the new stuff) and have learned a few new things about privileges.
the “SeeQueue” right basically lets a person create a ticket in that
Queue (via drop-down if they also have the “CreateTicket” right for
that Queue). The “ShowTicket” rights seems to be related to a user
finding tickets via Search/Query. For us, we allow some users to
“SeeQueue” and “CreateTicket” so they can create tickets but they
cannot find the tickets individually when in the web. Together, they
allow a person to create and look at the tickets. We give those rights
at the Role “Requestor” level per Queue (different Queue’s want
different levels of visibility for their users). “ShowComments”,
“CommentOnTicket”, and “ShowOutgoingEmail” are rights we reserve for
our support groups along with “ModifyTickets”, etc. (BTW, the
“CommentOnTicket” is superfluous if the “ModifyTicket” is granted).
Hope this helps.

Kenn
LBNL

Roy El-Hames wrote:

Hi there;

What rights should be granted to users on queues so these queues are
visible from the New Ticket in Drop down …
and also from the Queue drop down in the Basics section …
What I want is for some users to be able to create tickets and move
tickets to a particular queue, however they should n’t see the ticket
listing or search in any of these queues (ie the SeeQueue right shows
more that I would like) …
Any pointers will be appreciated …

Roy


The rt-users Archives

Community help: http://wiki.bestpractical.com
Commercial support: sales@bestpractical.com

Discover RT’s hidden secrets with RT Essentials from O’Reilly Media.
Buy a copy at http://rtbook.bestpractical.com


The rt-users Archives

Community help: http://wiki.bestpractical.com
Commercial support: sales@bestpractical.com

Discover RT’s hidden secrets with RT Essentials from O’Reilly Media.
Buy a copy at http://rtbook.bestpractical.com