{"action":"opened","issue":{"url":"https://api.github.com/repos/osTicket/osTicket-1.8/issues/2096","labels_url":"https://api.github.com/repos/osTicket/osTicket-1.8/issues/2096/labels{/name}","comments_url":"https://api.github.com/repos/osTicket/osTicket-1.8/issues/2096/comments","events_url":"https://api.github.com/repos/osTicket/osTicket-1.8/issues/2096/events","html_url":"https://github.com/osTicket/osTicket-1.8/issues/2096","id":78661787,"number":2096,"title":"RFC: Access Control 2.0 Mock-Up","user":{"login":"greezybacon","id":672074,"avatar_url":"https://avatars.githubusercontent.com/u/672074?v=3","gravatar_id":"","url":"https://api.github.com/users/greezybacon","html_url":"https://github.com/greezybacon","followers_url":"https://api.github.com/users/greezybacon/followers","following_url":"https://api.github.com/users/greezybacon/following{/other_user}","gists_url":"https://api.github.com/users/greezybacon/gists{/gist_id}","starred_url":"https://api.github.com/users/greezybacon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/greezybacon/subscriptions","organizations_url":"https://api.github.com/users/greezybacon/orgs","repos_url":"https://api.github.com/users/greezybacon/repos","events_url":"https://api.github.com/users/greezybacon/events{/privacy}","received_events_url":"https://api.github.com/users/greezybacon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-20T19:27:36Z","updated_at":"2015-05-20T19:27:36Z","closed_at":null,"body":"### History\r\nThe access control system has been *improved* (in italics) for osTicket v1.10:\r\n\r\n1. Departments can have children, which allows automatic, cascaded access\r\n2. Permissions are split from groups into a new \"Roles\" feature. The roles allow for re-use of the permission sets.\r\n3. Groups allow specifying a role when extending access to a department, which allows varying permission between departments an agent has access to\r\n\r\nThese new features are really nice and have been requested, however, they fail to solve a more obvious problem with osTicket: Agents, Teams, Groups, Departments, and now Roles are quite confusing. Folks often ask us for an explanation multiple times when setting up an osTicket help desk. We fear that adding the new \"Roles\" feature may be the tipping point for new user's understanding of osTicket access control administration.\r\n\r\n### Goals\r\nThis mockup tour is about presenting a different approach to the new features, while retiring and repurposing the \"Groups\" feature. There are several issues we hope to address with this rewrite, specifically:\r\n\r\n1. Adding agents, teams, departments, and email addresses are all cumbersome because they are inter-related. Therefore adding one means having to create something else first and visa versa. For instance, adding a team might require a lead, however, the agent might not yet be defined. Furthermore, adding members to the team might require adding the agents and coming back. Departments have members and a manager with a similar problem.\r\n2. The terms \"Group\" and \"Team\" are too similar, and often seem like the same thing to new users of the software\r\n3. There is no clear way to find out exactly what an agent has access to and what permissions they possess\r\n4. It is unclear which agents should receive which email alerts. There are at least three places to disable certain alerts for certain departments, teams, etc.\r\n5. The agent profile and agent management pages have far too many options on one page\r\n\r\n### Mockups\r\nAgent listing loses the \"group\" tab and the buttons on the bottom. Instead, a drop-down \"More\" menu is available like what is appearing throughout the rest of the software. The menu adds new options which will be clarified later.\r\n\r\n![01 agent listing](https://cloud.githubusercontent.com/assets/672074/7733680/545e0cec-fef6-11e4-88d4-8e0402c48b73.png)\r\n\r\n#### Manage an Agent\r\nFrom the agent listing, clicking on an agent's name will navigate to the agent management page (what it currently does). Authentication is broken out into a separate section, and the password reset feature is implemented as a separate dialog. The \"Backend\" selection is hidden if the system only includes the built-in \"Local Authentication\".\r\n\r\n![manage agent](https://cloud.githubusercontent.com/assets/672074/7734014/af2e0300-fef8-11e4-9f90-6cdcab32aaa5.png)\r\n\r\nPrimary department selection is moved to the \"Access\" tab, and the extended departments can be assigned directly to the agent (rather than through the \"Group\" feature). Optionally, alerts can be enabled when extending access to a Department. Furthermore, a set of permission (called a \"Role\") can be associated with all department connections, including the primary department.\r\n\r\nPermissions which do not pertain to a connected department are managed on the \"Permissions\" tab. This includes user directory, knowledge base, and search permissions.\r\n\r\nTeams can also be managed directly from the agent management page. Again, when connecting to a team, alerts can be optionally enabled.\r\n\r\n#### Set Password\r\nAdministrators can reset the password of agents (current feature). However, this is implemented in a pop-up dialog now with some new options. The administrator has the option to issue a password reset email to the user rather than setting a temporary password.\r\n\r\n![set password dialog](https://cloud.githubusercontent.com/assets/672074/7734027/cd1f7c0e-fef8-11e4-9958-74f0be825f22.png)\r\n\r\n#### New Dialog Boxes\r\nWhen managing an agent or anything that has a department selection, **— Add New Department —**, which will trigger a dialog box to add the Department in place. The new department is automatically added to the screen or to the drop-down list selection. \r\n\r\n![03 add department dialog](https://cloud.githubusercontent.com/assets/672074/7733810/4449e302-fef7-11e4-9533-629a3a571c61.png)\r\n\r\nThe new role box has only options for permissions which pertain to a department. This is distinct from \"global\" permissions, such as user directory permissions, which apply no matter which departments an agent has access to.\r\n\r\n![04 add role dialog](https://cloud.githubusercontent.com/assets/672074/7733831/71495db0-fef7-11e4-97e0-df9a7849e0ef.png)\r\n\r\nThe intention of the dialog boxes is to require as little information as possible to create the new item. Other options can be configured by visiting the page to manage the respective item.\r\n\r\n![05 add team dialog](https://cloud.githubusercontent.com/assets/672074/7733834/7426edb8-fef7-11e4-86c3-314090110742.png)\r\n\r\n#### Manage Department\r\nFrom the Agent listing, clicking on the title of the Department will navigate to the department management page (current feature). This page is tabbed to separate department settings and allow easy management of agents with access to the department. Primary members are listed in the list of members along with those who are extended access to the department. Optionally, alerts for each individual agent with access can be enabled. This allows for simpler configuration of users who need access to tickets but do not wish to participate in email alerts. If the department has the alerts to primary members only or has alerts disabled, then the `[ ] Alerts` options will be hidden or will be crossed out to indicate such.\r\n\r\n![manage department](https://cloud.githubusercontent.com/assets/672074/7734140/893347f4-fef9-11e4-8fa8-7668d4451ab8.png)\r\n\r\n#### Quick Add Agent\r\nWhen managing items which can have agents connected, such as departments or teams, the drop down boxes to select agents have an **— Add New Agent —** option which will trigger a quick-add agent popup dialog.\r\n\r\n![add agent dialog simple](https://cloud.githubusercontent.com/assets/672074/7734166/c38d7c4e-fef9-11e4-9eb1-f3847dad5911.png)\r\n\r\nThis dialog places the agent in the system default department and provides\r\n\"best experience\" permissions (those currently available to all agents in\r\nv1.9.8).\r\n\r\nAs an option, a temporary password can be set for the new agent rather than\r\nissuing a welcome email with a login link.\r\n\r\n#### Adjusting Permissions\r\nFrom the agent listing page, several agents can be selected and their permissions adjusted at one time, via the *Reset Permissions* mass action. The popup dialog will allow starting from an empty permission set or from the current permissions of an existing agent.\r\n\r\n![reset permissions dialog](https://cloud.githubusercontent.com/assets/672074/7734206/15324796-fefa-11e4-9a79-393af7bc0ba0.png)\r\n\r\nOnce an agent is selected the option and hint to select an agent is hidden. Cancel and reopen would be necessary to select a different agent. Furthermore, after selecting the first permission, the option to select an agent is also hidden to avoid confusion if the agent were to be selected later.\r\n\r\nChanging the primary department (moving) of agents is also available as a mass action.\r\n\r\n![08a set primary department dialog](https://cloud.githubusercontent.com/assets/672074/7734399/5ed43264-fefb-11e4-9cac-9223ad6fdada.png)\r\n\r\n#### My Preferences (-> rename to \"Profile\")\r\nThe agent profile page is tabbed to divide up the options available and to make room for more sophisticated and future features (such as multiple signatures and custom data).\r\n\r\n![agent account](https://cloud.githubusercontent.com/assets/672074/7734276/7a4a8472-fefa-11e4-8eab-737376baf968.png)\r\n\r\nSettings for the user experience including localization options, and user interface options are moved to a separate tab\r\n\r\nThe authentication information is not editable by the agent (current feature), and password reset is moved to a dialog.\r\n\r\n![10 agent password change dialog](https://cloud.githubusercontent.com/assets/672074/7734319/c3a78d90-fefa-11e4-98d5-6279ff4dde26.png)\r\n\r\n#### Add New Agent\r\nAdding a new agent is moved to a dialog to simplify the creation process. Three steps are shown in the dialog; however the process can be exited early to apply defaults to the other tabs. Once the agent is created, it will be added to the agent listing and can be managed as other agents to apply more sophisticated configurations.\r\n\r\n![add agent dialog copy](https://cloud.githubusercontent.com/assets/672074/7734338/e8939ab8-fefa-11e4-9bb9-acd1c8ad1d4e.png)\r\n\r\n#### Manage Team\r\nTeam management is enhanced to allow direct addition of team members on the \"Members\" tab. Again, agents can be quick added to the team without navigating to another page to add the agent first.\r\n\r\n![manage team](https://cloud.githubusercontent.com/assets/672074/7734370/2cdda858-fefb-11e4-838e-5061ef4a24fc.png)\r\n\r\n### Discussion\r\nFeedback is welcomed from the community (hence this post); however, we're not trying to create something that everybody can agree on. Instead we're focusing on fixing the confusing aspects of osTicket's access control configuration.\r\n\r\n**__NOTICE__**\r\nThe mockups depicted in this post are for visualization purposes only. Please do not comment on the placement of pixels, colors, phrasing, etc. Those things can be discussed as the features are actually implemented."}}