<chapter id="permission">
<title>Permissions</title>
<para>
This chapter will show you more details about OTRS permission. 
</para>

<sect1 id="permission-group">
<title>Group/User/Queue Permission</title>
<para>
You will be able to handle different groups of users with different permissions
(e. g. only read ticket in a queue or one group should not have ro/rw access
to a queue). 
</para>
<para>
Group permissions are "ro" (read only access to the ticket), 
"move_into" (permissions to move tickets into this queue),
"create" (permissions to create tickets in this queue),
"owner" (permissions to change the ticket owner),
"priority" (permissions to change the ticket priority) and 
"rw" (full read and write access to the ticket).
</para>
<para>
You can put users to groups and for each queue one group (user-group-queue). 
</para>
<para>
Example: If you want only read ticket in a queue or one group 
should not have ro/rw access to a queue) you need to:
<screen>
a) create otrs-groups
b) put the groups of users into your otrs-groups
    (you have a ro/rw option)
c) split/sort your otrs-queue to the otrs-groups
</screen>
</para>
<para>
There is a config option if 'ro' queues should be shown in QueueView.
<screen>
Kernel/Config.pm
[...]
    # QueueViewAllPossibleTickets
    # (show all ro and rw queues - not just rw queues)
    $Self->{QueueViewAllPossibleTickets} = 0;
[...]
</screen>
</para>
</sect1>

<sect1 id="permission-module">
<title>Module Permission - Agent/Admin Interface</title>
<para>
It's possible to grant permissions to a module in Kernel/Modules/*.pm. 
For example a group of users should be able to edit responses (modular default 
answers). Normally you need to be in the 'admin' group to do so. 
</para>
<para>
How it works:
<screen>
a) create a new otrs-group named 'responses'
b) put the group of users rw into this otrs-group
c) add to Kernel/Config.pm 
   [...]
   $Self->{'Module::Permission'}->{'AdminResponse'} = 'responses';
   [...]
d) add a link to the Agent Interface e. g. in Kernel/Output/HTML/*/AgentNavigationBar.dtl 
   [...]
   &lt;a href="$Env{"Baselink"}Action=AdminResponse">Response&lt;/a>
   [...]
e) restart the webserver if you use mod_perl
</screen>
After this all users in group 'responses' are able to access the AdminResponse 
module and to edit the responses.
</para>
<para>
It's alos possible to add more then one group (by perl array):
<screen>
   [Kernel/Config.pm]
   $Self->{'Module::Permission'}->{'AdminResponse'} = ['admin', 'responses'];
   [...]
</screen>
</para>
</sect1>

</chapter>
