>
can I use ACLs to restrict groups of agents to certain services?By design of ACL, you can do such a thing. However, the practical use of this question is another matter. As previously stated, services are attached to customers.
In one frame of reference, you can prevent an agent from choosing a particular service to apply to a ticket. (ok.. but that's probably already part of the ACL assigned to the queue of the ticket, not the agent or the agent's group.)
In another, you *might* be able to turn off interface options for an agent if the ticket has a certain service. (See the docs).
However, in reality, agents of the group(s) (and therefore, queues) related to, for instance, Software, will probably never see tickets of Service "toilet" because smart application of ACL will ensure that the customer cannot choose that combination on ticket submit, nor could random agent in Software see the ability to assign that Service ... Again, not because of the agent particularly, but because the ACL of the Queue the Agent belongs to already prevents this from happening.
Reworking this to your question *within* the Queue, for instance: Yes. You can do this. For instance, an agent can be a member of "Plumbing" but only provide answers on "toilets". The real question at this point is whether it makes sense to handle this via ACL or create an agent group and [sub]queue (Plumbing::toilets?) specifically for toilets. If you create a group for an agent, and you want customers to submit to Queues belonging to the group, you will need to either:
- make the customer a member of the group -- manually assign or CustomerGroupAlwaysGroups -- or
- turn off CustomerGroupSupport
The relevant code for the second option is in Kernel/System/CustomerGroup.pm
# check if customer group feature is active, if not, return all groups
if ( !$Self->{ConfigObject}->Get('CustomerGroupSupport') ) {
# get permissions
%Data = $Self->{GroupObject}->GroupList( Valid => 1 );
for ( sort keys %Data ) {
push @Name, $Data{$_};
push @ID, $_;
}
}
Which, I know, you can argue that it doesn't work that way, because:
>Disabling customer's group support denies access to any queue for customers.
At this point, it's important to know what version of OTRS you're using, because what you reported doesn't seem to comply with the code. (System Log error messages would be helpful, too.)