Roles

[Jure]

Hello,

I am little confused regarding roles in otrs so if anyone can explain on one easy and one advanced example.

Thanks in advance


Jure

[Mothra]

I struggled with this one at first - the manual's explanation makes it seem more complicated than it really is. You're basically adding in a layer of abstraction between users and groups to simplify user management with large numbers of agents. If it helps, you can think of it as a "proxy user".

I put roles firmly in the category of OTRS features that should be avoided until you actually need them. Here's a simple example of a problem that the roles feature solves:

You have 15 users, all of whom have identical access to the same group. Every time you create a new agent, you have to go into the users<-> groups screen and check all of the right boxes for them. This becomes tiresome and prone to error. So instead, you create a new role, then go into role<-> groups and give that role the same permissions as those 15 users. Now you can go into users<->groups and remove all their permissions for that group, because in the very next step, you're going to be adding those users to your new role. Now when you create a new agent, you simply add them to the role, and there's no tedious clicking of permissions checkboxes.

Btw, the manual "recommends" you disable the User <-> Groups setting in the Admin UI before using roles. Whether you do this depends on whether you jump in with both feet and replace all user<->group mappings with user<->role<->group, or whether you take a phased approach as in my example.

[ptay]

Hello,

I am little confused regarding roles in otrs so if anyone can explain on one easy and one advanced example.

Thanks in advance


Jure

Jure, I was confused for a bit but the light went off this morning when I was researching an issue detailed here. Roles enable you to save time managing larger #s of agents & queues. If you rely on Agents <-> Groups to manage queue permissions then as your OTRS scales up & changes then management will become more labor intensive.

Here is my simple example:

At the moment, I have about 60 Customer users who will create tickets for these queues:
Trouble queue
Information queue
Administration queue
Test Setup queue
Incident queue
Junk queue

Two sets of Agent users will work the above queues & cannot have access to each others queues. One set has seven agents while second has about 20 agents.

SysAdmin Agents will own:
Trouble queue
Information queue
Administration queue
Test Setup queue
Junk queue

Security Agents will own:
Incident queue

Let's say a few months later management determines we need to set up another queue called "Audit queue" which now 1/2 of all Agents in both sets would require access.

Possible steps for using Groups:
Set up a new group Audit Q Group
Set up Audit queue & assign Audit Q Group
Go into Agent <-> Groups & select from Group menu Audit Q Group.
Assume each Agent authorized would get all six permissions (ro,move,create,owner,priority,rw) then I would find 13 Agents and check 78 different permission boxes (13 x 6 = 78).

Possible steps using Roles:
Set up a new group Audit Q Group
Set up Audit queue & assign Audit Q Group
Go into Roles & set up new Role called Auditor Role
Go into Role <-> Groups & select from Group menu Audit Q Group.
Assume each Agent authorized would get all six permissions (ro,move,create,owner,priority,rw) then I would check six boxes.
Go to Agent <-> Roles and select Auditor Role from Role menu.
I would find 13 Agents & check 13 boxes.

Overall you'd save over 50 clicks in this simple scenario.

I can imagine others are using OTRS with much more complex and larger installations so hopefully this example shows you Agent <-> Roles can scale much easier than Agent <-> Group.

[Jure]

Mothra wrotes
"Btw, the manual "recommends" you disable the User <-> Groups setting in the Admin UI before using roles. Whether you do this depends on whether you jump in with both feet and replace all user<->group mappings with user<->role<->group, or whether you take a phased approach as in my example."


so i cannot use roles and Customer-Group together? How can i make customers to see only specific queues then?


Thanks
Jure

[crythias]

so i cannot use roles and Customer-Group together? How can i make customers to see only specific queues then?

Mothra's talking about agent (user) groups, not client (CustomerUser) groups.