Group queues for overview?

[xhoy]

Hi all!

We use otrs for over 6 years now and it does fit for all our needs and works great, the upgrade to 3.1.1 (with in/outbound phonecall's ) is great!

But over time the company has grown and we are not able to get the overview we need!

Situation:
We have a lot of queues and sub queues (60+)in OTRS. Some of these are based on departments for example: finance / finance::invoices / finance:: debtors / finance:: creditors or for example helpdesk::to-do / helpdesk::call helpdesk::appointment helpdesk::quotes.

The helpdesk sometimes get a question about one of the cases (email) that is owned by the finance department. Most of the time they are able of answering the question and need to update the case. But for them it’s just another call with another customer. They do not bother if it is a creditor or debtor queue.

Problem
all users do see all queues. And when they move any ticket the need to scroll along this very long list.

The same thing goes the other way finance sometimes needs to know something from support (how much work was it, is there special agreement with the customers, but they do not know and want to know exactly in whitch queue the mail is. They need too scroll along the long list of queues as well.

Desired solution
So I would like to define ‘queues’ and ‘sub queues’ per group when the finance:: queues look like one queue for the helpdesk agents and the helpdesk queues look like one queue for the finance department. When they move tickets they should be only able to move them in the desired group-queue and the other department should take over.

Possible solution
Other problem with permissions I can only remove permissions for a queue but then they can’t view anything inside the queue, when I enable read permissions it shows up in the list when moving a ticket. so this doesn't solve anything.

Help!
Any suggestions on how to create a situation that would give us the desired situation?

[ferrosti]

You should setup your permissions more granular. There is a permission called 'move_into' that is AFAIR not enabled per default and needs to be entered manually into the list. Search SysConfig for System::Permissions.

For working with OTRS it sometimes helps to build stored searches. It´d be only a few clicks then to open a specific ticket list.

[xhoy]

You should setup your permissions more granular. There is a permission called 'move_into' that is AFAIR not enabled per default and needs to be entered manually into the list. Search SysConfig for System::Permissions.

For working with OTRS it sometimes helps to build stored searches. It´d be only a few clicks then to open a specific ticket list.

When a user has RW permissions on 'all queues' and only move_into on 1 queue the list is populated with alle queues where the user has RW rights on.

This isn't a solution. BUt could try to edit the view on this, any suggestions?

[xhoy]

Oke i was thinking about this.

It would be more logical if OTRS would only show queues where the user had 'move_into" permissions for. instead of all queues with RW rights.

As far as i can see there is no way to configure this behaviour?

[xhoy]

Oke update:

my %MoveQueues = $Self->{TicketObject}->MoveList(
TicketID => $Param{Ticket}->{TicketID},
UserID => $Self->{UserID},
Action => $Self->{LayoutObject}->{Action},
Type => 'move_into',
);


The code is there /Kernel/Output/HTML/TicketMenuMove.pm BUT RW permissions INCLUDE move_into permissions. When a agent hasn't got RW permissions it cant add changes to the tickets.

So is there a way to give user RW permissions WITHOUT move_into?

[ferrosti]

WTF?
Why the heck do you apply rw permissions in cases you do not want them? Give all permissions you need, and no more. What's the matter?

Please read about what roles and groups are for to achieve what you want, rather than raping some other code to suit your needs it is not intended to.

[xhoy]

I do want RW permissions for a agent on a queue but they should not have move_into permissions (atleast that seems the most logical why to remove the queues from the change queue list).


The bottom line is that i do not like all queues to showup in the change queue list... but all agent should have RW permissions?


So when a user has NO move_Into permissions it doesn't show up in the change queue list, but when a agent has RW permissions it automagicaly gets move_into permissions.

Is there a way got give RW permissions WITHOUT move_INTO permissions?

[jojo]

RW includes all permissions.
There are a lot of different permissions (some switched on per default, some not)

Permissions switched on per default are:

ro: allows reading of all tickets in the queue
create: allows ticket creation in the queue
move_into: allows movin into this queue
note: allows adding notes and being recipient of a note
owner: beeing owner and setting owner
priority: changing priority of the ticket


Some additional ones are:
compose: write an answer via mail to the customer
close: close the ticket
forward: forward an article
...

rw always include all permissions, you will only need rw permission if the person should be able to work completly on the ticket. For just adding info ro and note are suitable

[xhoy]

I don't get this, in my list i have only the once listed below?

Yesterday i tought i was kinda weird that there was only RO move_into_ create note owner priority and RW and when RW wasn't set ther missed allot of options.


Is there a full list of possible permissions?
http://doc.otrs.org/3.1/en/html/stats-m ... ermissions

isn't really clear on this!

EDIT: ow, i would like to set ALL permissions EXCEPT move_INTO!

[jojo]

again, this makes no sense and is not possible

[ferrosti]

RW overwrites all permissions you have set ahead. Leaving out 'move_into', but setting RW will still give all permissions and is just like every other permission system works like, let it be windows file permissions, Active Directory or whatever. RW always includes everything.
To deny access to a single function you need to exclude RW, as well as the deniable function. That´s the way it goes. And it does not make sense complaining, since this is the way it works everywhere.

In case permitting everything except for 'move_into' and 'RW' still messes something up, this would be another problem, but this is the way to go. In case an agent won´t be able to compose an article on a ticket with this setting one would have to add this permission to the permission list and allow it, or whatever the resulting problem is.

[xhoy]

@ferrosti

why cant I enable the compose permissions separate from the RW permission? it seems to me that the permission structure is not granular enough?

So back to my question where can I set the additional permissions? (like compose close and forward?) I cant find any reference to them in the source code?

Could i just add them my self?

I found this inconstancy:
Modules/AgentTicketPhoneCommon.pm (and in some other module files)
96 # check permissions
97 my $Access = $Self->{TicketObject}->TicketPermission(
98 Type => $Self->{Config}->{Permission},
99 TicketID => $Self->{TicketID},
100 UserID => $Self->{UserID}
101 );


Modules/AgentTicketMove.pm
81 # check permissions
82 my $Access = $Self->{TicketObject}->TicketPermission(
83 Type => 'move',
84 TicketID => $Self->{TicketID},
85 UserID => $Self->{UserID}
86 );
This would suggest the permission type is "move" so when i would define all other permissions (compose, close, forward) and change the "type"on all locations it would work?


NOTE: my coding skills are very limited so this could be a stupid question.

@jojo, i know it is not possible at the moment, but i would love to use this since we some users are getting lost in the long long list of tickets
@jojo, don't you think it is weird that RW defines almost all permissions? and you can define it really detaild (everything of nothing, almost)


Thanks for the help so far!

[ferrosti]

RW means all permissions! It is not ALMOST everything, not even NEARLY everything, RW means EVERYTHING! As soon as RW is given, there is nothing hold back, denied or anyhow restricted anymore and it does not matter whichever additional permission is given, since RW got them all!

So, you can enable 'compose' seperate from RW. The permission structure is very granular, you just don´t get it. You´ll never ever set RW, as long as you do not want everything to be allowed. In case you want something other than everything, go and configure it the very straight forward, granular way.
For agents who should do everything on a queue you need to set up a role with RW on the queues group, and other permissions on other groups (through their respective role).
For agents who should read, move_into, add notes and nothing more, you´d have to apply these permissions to it and nothing more, especially no RW!

You do not need to change anything in OTRSs code. If you had read my post carefully you would have seen this:

Search SysConfig for System::Permissions.

Set these values in SysConfig just as desired and you are good to go.

[xhoy]

@ferrosti, i think there is al littel miscommunication.

I know that RW is ALL permissions but, I dont get why i cannot set all other permissions seperately (see screenshot). It would be more logical if there where more options.


SO as you suggested i could set compose, forward etc by hand in system::permissions. That isn't aproblem except i do not know what options I have and could add there except the list you provide witch starts with "some additional ones are...". That is why i tought that maby the source code needed some work to force specific permissions types.

Resume: Is there a list where i can find all other additional 'permissions levels' or 'permission types'? and where could i find the full list?

[xhoy]

AAAAAAAAAAAAAAAAH now i get it

http://doc.otrs.org/3.0/en/html/Ticket.html

System::Permission
Description Value
Description: Standard available permissions for agents within the application. If more permissions are needed, they can be entered here. Permissions must be defined to be effective. Some other good permissions have also been provided built-in: note, close, pending, customer, freetext, move, compose, responsible, forward, and bounce. Make sure that "rw" is always the last registered permission.
Group: Ticket
SubGroup: Core::Ticket
Valid: 1
Required: 1
Config-Setting:

$Self->{'System::Permission'} = [
'ro',
'move_into',
'create',
'note',
'owner',
'priority',
'rw'
];


Didn't know there was documentation on this.


Thanks for the help!!

The list in the documentation isn't complete; so i was searching for the full list! but there isn't one list.

EDIT:
I figured (and realy dont get why this isn't default loaded in the configuration?!?)

Code: Select all

Ticket::Frontend::AgentTicketMerge###Permission
Ticket::Frontend::AgentTicketFreeText###Permission 
Ticket::Frontend::AgentTicketForward###Permission 
enz enz enz

search for "permissions" in Sysconfig to find all.

here is the permission defined that need to be added to

Code: Select all

System::Permission 

Some permissions are hard code into the system like move_into (why this is isn't clear to me, seems to be legacy?)
other permissions like freetext and merge are set by default to "rw" (why ?!?)

Works great now by the way, thanks for all the help!

Edit 2:

turns out that the change queue button users (hard code) the permission "move" to get the change queue button you need to add the permission group 'move"

Edit 3:

Dashboard permissions are default set to RW, there could be a new group (per dashboard item) or just a dashboard item

[banzayats]

...So is there a way to give user RW permissions WITHOUT move_into?

Yes! We found the solution.
You have to edit Kernel/System/Group.pm file and comment some lines:

Code: Select all

409 # check rw rule (set only rw and remove rest, because it's including all in rw)
410     if ( $Param{Permission}->{rw} ) {
411         %{ $Param{Permission} } = ( rw => 1 );
412     }
...
1119 # check rw rule (set only rw and remove rest, because it's including all in rw)
1120    if ( $Param{Permission}->{rw} ) {
1121        %{ $Param{Permission} } = ( rw => 1 );
1122    }
...
1665    push @Types, 'rw';

So now, you can go to Admin - Agents <-> Groups or Admin - Roles <-> Groups and setup permissions: now you can leave RW permission on but disable any other.
Don't forget to add some adittional permisions (Sysconfig - Core::Ticket - System::Permission). For example, we added note, close, pending, customer, freetext, move, compose, responsible, forward, bounce, phone . So now we get more custmizeble permissions.

[vitovinciolo]

Hi,

I´m newbie in OTRS and I trying to install and configure this app in my company.

Thanks in advance for this post, because is very helpfull add those "hidden" permissions and managed them separately.

I have one question:

Edit 3:

Dashboard permissions are default set to RW, there could be a new group (per dashboard item) or just a dashboard item

@xhoy: Where did you see dashboard permissions are default to RW ? Because searching "Permissions" in Sysconf I didn´t find it. Should I add "dashboard" group permission to System::Permission ?

I need that my agents can view all tickets queues in dashboard, but I won´t set RW permissions to them.


Regards.

[ferrosti]

Thanks in advance for this post, because is very helpfull

No, it is not, since this is the most painful way to configure OTRSs permissions!

I´d recommend to
1. setup Groups for your Queues
2. setup Queues
3. setup Roles on your Groups

xhoy is mixing up Dashboard permissions with groups assigned to the Dashboards Frontend to permit access. You can find them in SysConfig at 'Frontend::Agent::Dashboard', by entering the desired groups.

[vitovinciolo]

Thanks.

I changed 'Permission' key at

Code: Select all

Ticket -> Frontend::Agent::Dashboard 

for all items. I create dashboard permission group in

Code: Select all

System::Permission

Now all my agents can see all their tickets in dashboard view without RW permission on that queues.

Is there any other way to give to my agents this feature ? I can´t give RW permission to all queues for security reasons.

[ferrosti]

It is enough to have RO permission to see the tickets in Dashboard view.

[xhoy]

@vitovinciolo everyting clear now? Works great for us, the interface is mutch less cluterd.

Thanks for the help!

[deragoku]

And may refuse to function. This is the way it goes. It does not make sense to complain, because this is the way it works everywhere.

[xhoy]

Just for the record.

To get the desired result do the following:

Add these permissions to: Core::Ticket::System::Permission
stats
bounce
close
compose
customer
forward
MasterSlave
note
owner
pending
phone
Visit
priority
responsible
ro
move_into
create
owner
* these already exist in the list
You can now edit the permissions of groups and rols and users.

When you give users all permissions except the RW permission but you like them to see all tickets in the queue
Set Ticket::Frontend::AgentTicketQueue###ViewAllPossibleTickets to Yes


You could now give them all permissions except the move_into and they can see all tickets in the queue but they cant move tickets in there.