Users, groups and roles

Users

Via the link Users you can enter the user management of OTRS. Administrators can add, change or deactivate user accounts. Administrators can also manage user preferences, for instance the language of the user interface and notification settings for individual users.

Note

To keep the consistency of the data for OTRS it is not possible to delete a user account. To deactivate an account set it to invalid or invalid-temporarily.

Note

To keep the consistency of the data for OTRS it is not possible to delete a user account. To deactivate an account set it to invalid or invalid-temporarily.

After you have created a new user you should make it a member of one or more groups or roles. You will be redirected automatically to the screen for the group and user management when you finished creating a user account.

Groups

Every user account should at least belong to one group or role. You can access Group management via the groups link.

Note

To keep the consistency of the data for OTRS it is not possible to delete a group. To deactivate a group set it to invalid or invalid-temporarily.

After installation three pre-defined groups are available.

Table 5.1. Default groups after OTRS has been installed

Group Description
admin Group for the users who should perform administrative tasks in the system. After the system has been installed only the user "root@localhost" is in this group.
stats Users in this group may access the stats module of OTRS and generate statistics. After the system has been installed only "root@localhost" belongs to this group.
users This is the group where your agents should belong to and have read and write access. If users are in this group and have write rights they can use all functions of the ticket system. After the system has been installed this group is empty.


To add a user to a group or to change the users inside a group you can use the link Users <-> Groups.

An overview of all groups and users in the system is displayed in the lower part of the screen. If you want to change the groups that a user is a member of just click on the user name. To change the users that are part of a group just click on the group you want to change.

Users can have different rights in a group. Below is a list of the permission rights available:

Table 5.2. Rights in the user groups of OTRS

Right Description
ro Read only access to the tickets and entries or queues of this group.
move into Right to move tickets or entries between queues or areas that belong to this group.
create Right to create tickets or entries in the queues or areas of this group.
owner Right to update the owner of tickets or entries in queues or areas that belong to this group.
priority Right to change the priority of tickets or entries in queues or areas that belong to this groups.
rw Full read and write access on tickets or entries in the queues or areas that belong to this group.


Note

By default, the QueueView only lists tickets in queues that an agent has rw access to. The idea behind it is that the QueueView lists only the tickets the agent needs to work on. If you'd like to change this behaviour, you can set Ticket::Frontend::AgentTicketQueue###ViewAllPossibleTickets to Yes.

Roles

Roles are a very powerful and helpful feature to manage and change the access rights of many users very simply and quickly. On big and complex systems with many users, groups and queues this feature is very useful and helps to save time.

To explain the advantages of the role feature imagine that you have a system with 100 users. 90 users have access to a queue called "support" that contains some sub queues. All support requests are handled through this queue. All other queues of the system are not accessible for the 90 users. The other 10 users may access all queues of the system, they are not restricted only to the support queue. they dispatch tickets, watch the raw queue and move spam messages into the "junk" queue. Some day the company opens a new department that sells products. Offerings, confirmations of offerings, bills, e.g. must be created and some of the agents in your system shall do this via OTRS. The different users have to get access to the new queues that must be created. Because it would take a long time to change the access rights for the different users manually, roles can be created that define the different access levels. Then the users can be added to one or more roles and the user rights get for this user accounts get changed. If a new user account is created it is also possible to add this account to one or more roles.

Note

Roles are really useful when maintaining larger OTRS installations. You should not use both User to Group and User to Role mappings at the same time though, this would make maintenance really hard. Therefore, if you decide to go with roles, we'd recommend you to to disable the Users <-> Groups option in the Admin area by modifying the front-end::Admin::ModuleRegistration in SysConfig. Of course this would not remove already existing User to Group assignments!

Note

To keep the consistency of the data for OTRS it is not possible to delete a role. To deactivate a role set it to "invalid" or "invalid-temporarily".

To define the different access rights for a role the links "Roles <-> Users" or "Roles <-> Groups" can be used.