Hi there, Our RT instances have this basic conf: RT 4.2.9, CentOS 6.6, mysql Ver 14.14 Distrib 5.6.22, for Linux (x86_64)
We are trying to restrict rights as much as possible for "external" users (those having access to RT via a custom web application.) In terms of group rights, this is what we would like to have: 1. Everyone -> CreateTicket + ReplyToTicket 2. Privileged -> None (empty) 3. Requestors -> CreateTicket + ReplyToTicket + SeeCustomField + ShowTicket + ModifyCustomField + ModifyTicket However, these conf especially Privileged->None seems to be blocking access to custom fields. Doing a little research I found this: http://requesttracker.8502.n7.nabble.com/REST-API-and-WebExternal-Auth-td52611.html """ Is the user who is logging in via REST marked as Privileged in the admin UI? If not, they don't have access. You'll either need to allow Unprivileged users access in the config or mark your users Privileged. """ So, after marking external users as privileged I found that the configuration shown above still doesn't work, only after setting Privileged->SeeCustomField + ModifyCustomField Shouldn't the fact that users are 'Requestor' be enough to let them read/write custom fields? -- Regards, Hugo Escobar <http://www.associationfinancialservices.com/> 4770 Biscayne Blvd, Ste 700 Miami, FL 33137 main: 305.677.0022 support: 305.921.4620 email: hesco...@afslc.com Follow us on Facebook and Linked-In <http://www.facebook.com/pages/Miami-FL/ASSOCIATION-FINANCIAL/64952991864> <http://www.linkedin.com/companies/1006276> NOTICE: This email and any attachment to this email may contain confidential information. If you are not the intended recipient, you must not review, retransmit, convert to hard copy, photocopy, use or disseminate this email or any attachments to it. If you have received this email in error, please notify us immediately by return email and delete this message. Please note that if this email contains a forwarded message or is a reply to a prior message, some or all of the contents of this message or any attachments may not have been produced by our firm. *As our firm may be deemed a debt collector, if your payment is in default, we may be attempting to collect a debt on behalf of the association, and any information obtained may be used for that purpose.*