Roles

Introduction to Role Administration

Roles provide access rights and views, they specify what an engineer is allowed to do or to see. Without a role, an engineer can log in to the system but cannot perform any actions. Only by being assigned one or more role(s) does an engineer obtain system permissions. For each task in a company using the system there should be a role which defines its permissions. Engineers fulfilling the task should have this role.

When engineers log in to the system, they will have all permissions from all roles they have been assigned. So all permissions are added! There is no way of explicitly preventing access to objects in ConSol CM - access can only be granted! The sum of all granted permissions defines the final permissions for the engineer.

Roles define:

Role Administration Using the Admin Tool

You reach this screen by opening the navigation item Roles in the navigation group Access and Roles.

You might also see this screen when you have worked in the Engineers and have selected Jump to role for a role in the role list of an engineer.

Figure 17: ConSol CM Admin Tool - Access and Roles, Roles: Queue permissions

You see the list of all available roles on the left-hand side (1) and the permissions which can be granted on the right-hand side (2). In the list of roles, all roles which have been set as main role for at least one engineer are marked with a red dot. You always work on the access permissions of the role which has been selected in the list of roles. Only one role can be selected at a time. You can use the buttons below the list of roles (3) to add, delete or copy a role.

On the right-hand side, several tabs are available:

All changes in the Role Management tabs take effect immediately or after clicking the OK button. You do not have to click the Synchronize button in the icon bar.

In the Web Client, engineers have to log in again to use their new roles. Views become effective after pressing F5 (page refresh).

Working in Role Administration, you always mark a role and then can display and modify the parameters of this role. However, it is not possible to display a list of all engineers who have been assigned this role. In order to have such a list displayed, please change to Engineers (navigation item Engineers) and filter the engineer list for a certain role.

Please note that you can edit the name of a role by clicking on it in the list of roles and by modifying the name as required.

Create a Role

Click the Add button below the role list to create a new role. A pop-up window appears where you can enter the role name. Since the role name is used only for admin purposes and not displayed in the Web Client, no localization is required here. Afterwards you have to set the permissions of this role using the tabs on the right side of the page (see also the preceding picture).

Tab Queue Permissions

The permissions set in this tab apply to the selected role (left part of page) and the selected queue (center part of page). Without an entry here, an engineer with this role is not able to see tickets nor to perform any actions in the system.

You reach this screen by clicking the Queue Permissions tab in the navigation item Roles, navigation group Access and Roles.

Figure 18: ConSol CM Admin Tool - Access and Roles, Roles: Setting queue permissions

The following permissions can be set:

You can define for which range of tickets the permissions are valid:

Click the corresponding checkbox to assign one or more permissions for the desired ticket range.

Two general permissions can also be set:

If you want to select all permissions simultaneously just click the Select all button below the list. Clicking Deselect all removes all selections.

Tab Global Permissions

Global permissions are general and queue-independent rights for a role. Setting these permissions is optional.

You reach this screen by clicking the Global Permissions tab in the navigation item Roles, navigation group Access and Roles.

You can specify the following:

Tab Customer Group Permissions

In order to let engineers work with customer data from one or more customer groups, e.g. to edit reseller data sets or to create new contact data within the customer group, you have to grant access permissions concerning the customer group(s) to one or more roles.

You reach this screen by clicking the Customer Group Permissions tab in the navigation item Roles, navigation group Access and Roles.

Figure 20: ConSol CM Admin Tool - Access and Roles, Roles: Assigning permissions for customer groups to a role

A concept which has proven very useful in various customer environments is the set-up of specific roles for customer data management. For example, there could be a role CustomerManager_CustomerGroup1 and another role CustomerManager_CustomerGroup2. You can even differentiate between CustomerManager_CustomerGroup1_full and CustomerManager_CustomerGroup1 _light. In this way, you can use the assignment of the customer manager roles as a toggle and you do not mix up queue access permissions and customer management permissions. This can be very helpful in case you have a heterogeneous team in which not everyone is allowed to edit the complete customer data.

However, do not forget to grant read permissions to customer data of the required customer groups to all engineers of the respective queues! Otherwise, they cannot open their tickets at all!

Customer permissions can be granted separately to the general sections (1) and the Comments and Attachments section (2).

Figure 21: ConSol CM Web Client - Sections of a contact page

The following access permissions can be granted:

Please keep in mind that an engineer must have at least read permissions for a customer group to open and/or create tickets for customers in this group!

Tab Resource Types Permissions

Resource types permissions control an engineer's access to resources, i.e., objects which are stored in the Resource Pool.

You reach this screen by clicking the Resource Type Permissions tab in the navigation item Roles, navigation group Access and Roles.

Figure 22: ConSol CM Admin Tool - Access and Roles, Roles: Resource types permissions

The following permissions can be granted:

Tab Views

Views define which tickets engineers will see in the ticket list of the Web Client. This tab shows the assigned views on the left and the available views on the right (see also Views). The displayed views can be filtered by name and queue. Assigning views is optional.

We recommend to assign at least one view to a role. Otherwise an engineer with this role will see no tickets in the Web Client's ticket list.

You reach this screen by clicking the Views tab in the navigation item Roles, navigation group Access and Roles.

Figure 23: ConSol CM Admin Tool - Access and Roles, Roles: Views

Select a role on the left side of the page first and then the desired view(s) in the list of available views. Click the Assign button to move the selected view(s) to the list of role views. If you want to remove views from this list, select the respective views and click the Unassign button.

For regular roles, you cannot define the order of the views here. In the drop-down menu of the Web Client, the views will always be displayed in the order they have in the list of the view administration. Please see also section Views. When a role has been marked as main role for at least one engineer (and is thus marked with a red dot), the views can be sorted using the Move upwards and Move downwards buttons. The sorting affects the order in which the views are displayed in the Web Client.

Tab Engineer Functions

On this tab you can assign engineer functions to a role. Engineer functions are used if you need an additional engineer for a ticket, e.g., a supervisor who has to decide what to do before the ticket can be moved on in the workflow. Thus you have to assign a role with the respective engineer function to this supervisor. In the Web Client engineer functions and associated engineers are shown when assigning an additional engineer.

You reach this screen by clicking the Engineer Functions tab in the navigation item Roles, navigation group Access and Roles.

Figure 24: ConSol CM Admin Tool - Access and Roles, Roles: Engineer functions

Select a role on the left side of the page and then the desired engineer function(s) in the list of available functions. Click the Assign button to move the selected function(s) to the list of role functions. If you want to remove functions from this list, select the respective function(s) and click the Unassign button.

After you have defined the new role by setting permissions, views, and engineer functions in the tabs you can assign the role to the desired engineer accounts. Engineers obtain the rights of a role immediately after assignment (without an additional update of the system).

Delete a Role

Select the role you want to delete and click the Delete button below the role list. If you choose Yes in the following confirmation dialog, the role is removed from the list and the system.

If you delete a role, please consider that engineers with only this role will immediately lose all permissions in the system.

In case tickets, e.g., from a certain queue, are not covered by any role permission, engineers and/or administrators could get the impression that tickets are missing.

Copy a Role

If you want to create a new role and use an existing role as a template you can copy it. Select the existing role and click the Copy button below the role list. A pop-up window appears in which you can enter the name for the copy. Afterwards you can modify the copy according to your wishes.

Edit a Role

Select the role you want to edit in the list and modify the permissions in the respective tabs as desired. The changes are immediately effective for engineers with this role. The engineer just has to login again.

Defining Additional Administrator Roles

There are three types of administrator permissions:

There always needs to be at least one role with global administrator permissions and one user with this role. If required, you can create roles for additional administrators. This can be useful, for example, to create a user administrator role which can be assigned to the power users of the system. In this way, you can enable team leaders to create and delete engineers without giving them access to the rest of the configuration.

Roles with global administrator and configuration administrator permissions are displayed in a red color. Roles with engineer administrator permissions are displayed in a brown color.

Impact on Access and Role Management

Administrators cannot assign roles or permissions of a higher level or manage engineers who have roles with higher level permissions. Therefore, some restrictions regarding role and engineer management apply for the configuration and engineer administrator. These administrators cannot perform the following actions:

These restrictions apply to the following permissions:

Configuration administrator:

Engineer administrator:

The permission which the current administrator is not allowed to assign are grayed out.