Hi Anton,
Based on your case, I built up the following settings:
1. Be understood the “User” in OTRS is actually Agent not Customer.
2. Went to Sysconfig -> Frontend::Customer , enable
“CustomerGroupSupport” and Delete the default value (Users, Info) from the
“CustomerGroupAlwaysGroups”. This way the customers are not longer in the
same group unless you set up another common group for them.
3. Created test1, test2 as 2 customers with same customer ID, created
CustomerSubmit1, CustomerSubmit2 as 2 Queues. Created TestGroup1, TestGroup2
as 2 test groups.
4. Assigned test1 to TestGroup1 and has read and write rights,
assigned test1 to TestGroup2 and has read rights only. Assigned test2 to
TestGroup2 and has rights to read and write.
5. Assigned test1 to queue CustomerSubmit1, assigned test2 to queue
CustomerSubmit2.
6. Now, user test2 can not read user test1’s tickets, despite they
are under the same CustomerID.
Jack
_____
From: Anton Gubar'kov [mailto:anton.gubarkov@gmail.com]
Sent: 2008年11月11日 11:36 AM
To: User questions and discussions about OTRS.
Subject: Re: [otrs] company tickets access control
Colleagues, I'm sorry for putting so much confusion into the case.
I'm an IT service provider for company Acme. I support Acme's ERP system.
My agents are trustworthy.
Acme has users Ann and Mallory. Ann is a financial controller. Mallory is
salesman.
Mallory wants to hijack Ann's privilege to release credit blocked orders in
Acme's ERP to satisfy his customer with credit block..
Mallory tries to login 5 times using Ann's user id and causes it to lock.
Mallory starts to watch Company tickets waiting for Ann to raise a password
reset request with me.
Ann raises a password reset request.
Mallory continues watching waiting for the new password to appear on Ann's
ticket.
Before Ann has a chance to change her new password, Mallory logs in as Ann
and releases the blocked order.
I want to control an access to tickets from my customer's users. Can you
suggest a way to resolve this case?
2008/11/11 Jie(Jack) Zhu