Questions about rights management

[Sheep]

Greetings everyone,

i'm a new user of supportsuite since yesterday but it's been a while that i've been watching over the forums and trying the demos thoroughly.

The thing is that i couldn't find an advanced feature about right management, or maybe it's not a feature but a more complex manipulation that needs to be done.

Here is the idea:
It's based on user groups and groups level.


For exemple, i want that users in the lvl1 group get access to some files that registered users can't, users in the lvl2 and lvl3 get automatically access. I'm only talking about files, but this can be applied to KB & stuffs.

As the idea with "privilege escalation" is kinda complex, lets just think with 1 level group.



I'd like to get for each group a customized access to files.
The only way i saw was to use "password protected files" but that's kinda boring for the user to enter again a password, and they can see files were they can't get access, that's frustating.

The big question of this post is "is there a way to do something like that?"

If not (as i think i saw), i might devellop a module to handle that (i (... my company EONA in fact ... but i'm the ONE on the project :P) have the supportSuite owned version) and i would distribute it freely or submit it to the kayako team. So here is, quickly, my idea:




You have to read it from bottom to top:
The server has a default configuration : like "new file get hidden" or "new file get public" (this option should be always put at "hidden")
Green means: can be seen
Red: can't be seen
Grey: use the option of the higher level.

The cases are about the access to 1 specific file.
Case 1: As you can see, the server says it's public by default, but as there is a rule in the workflow it stops at the notregistered level. So, that file can't be seen by anyone.

Case 2: Same idea, but now, only registered users will see the files.

Case 3: here you can see how categories overide the server default configuration. Not registered AND registered users won't see the file because the category is set like that. Registered users in the upper groups will have access to it, but not the lvl2 one (it's kinda stupid, but it's only to show you how it works).

Case4: lvl2 get access to the file because lvl1 can. The grey access means: "use the actual right in the privilege escalation tree". lvl3 and upper groups won't get access.

Case5: lvl1 doesn't have access to the file, but it should be possible that A specific user get a special privilege (but not the group!)

The last case shows how the rights have to be checked:





User right are the highest level of right.


Well... that's the global idea.
Let me know if the basic one (the 2 first images) can be done with the current supportsuite, or let me know if you're interested with the "project".

I hope it was understandable... you know... it's a french writing english

[Jamie Edwards]

Hi Antoine,

The user rights system of SupportSuite is fairly simple. The guest group is used to configure permissions for a guest user. When a user registers, they are placed the template group's default registered group which has for it a set of permissions.

Users cannot be part of more than one group, and these groups are not tiered.

[Sheep]

When a user registers, they are placed the template group's default registered group which has for it a set of permissions.

So, where do you configure the permissions of a group for a specific file or category?

[Jamie Edwards]

This is done within the staff control panel, under Users and then under Manage Groups. Click on the group you wish to edit the permissions for.

[Sheep]

Well ... this section is only to handle access permissions to modules (like: download, KB, tickets).

When i'm talking about "files and categories" it's all about the content inside the download module

Or ... am i missing something?

http://www.sheep.fr/EONA/UserGroups.jpg

[Jamie Edwards]

I see what you were meaning now

I'm afraid there is no way to give permissions to groups for each category explicitly.

You could do this by passwording files and handing out the password, or use template groups (assign a group to a template group and make a category available to a specific group only (per category setting)).

[Sheep]

OK, i'll start a thread in the devellopement forum then

I think there might be some people interested.

[Jamie Edwards]

Please start it in the Feature Requests forum

Thanks,

[Sheep]

Well... it's not really a feature request as i'll do it myself for the company where i'm a trainee

But if there is something similar under devellopment let me know.

Edit: the dev forum was refering to the "Modifications, Languages and Addon Development " forum in Customisation