18.0.8.935 - System wide access is no longer allowed for Group Owner and Group Admins.

[stuart.haddad@itstrategic]

It appears some changes to permissions in the latest releases have changed some desired behaviour for one of our clients. I'm referring to:
https://www.3cx.com/community/threads/console-restrictions-for-webclient-admins.119537/

These restrictions for Webclient's admin section will be implemented in Update 8.

https://www.3cx.com/blog/change-log/phone-system-change-log/

• 18.0.8.935 - System wide access is no longer allowed for Group Owner and Group Admins.

We previously had allowed some staff members access to the Admin Console, via the webclient, to update ring groups. Previously we had been able to unrestrict admin access via the webclient to allow these users to manage the ring groups from any location, but still allowed us to restrict the admin console. Update 8 seems to have enforced the console restrictions on to the webclient.

We also previously had to make these users Group Admins to enable this access, however, it seems with the latest change that is no longer allowed?

With these latest updates we've had to unrestrict the console to anywhere, and update the documentation for these users to update the Ring Groups via the Admin Console rather than the webclient.

Are there any plans to allow separate restrictions for the admin console and the webclient? What is the least permissive rights needed to allow updating the Ring Groups section from the webclient with the newest updates?

 

[SteveITS]

https://www.3cx.com/community/threads/v20-3cx-reloaded.122495/
Sounds like the management console will completely go away in v20.

 

[N_G]

Group admins can manage any extensions within their group. So if those ring groups are part of the same group as the Group admin then they can manage them.....

 

[Dominion-Don]

Group admins can manage any extensions within their group. So if those ring groups are part of the same group as the Group admin then they can manage them.....

It seems the update would have made all existing ring groups, queues, etc. part of the DEFAULT group vs. systemwide. As of now, existing group admins can no longer manage settings and there is no apparent way to re-assign the groups, queues, ivrs, etc. to a group once it created. Per 3CX support, we are to delete and re-create which is not feasible. Will you be adding the option to re-assign after the ring group/queue/ivr is created? Maybe a hotfix prior to v20? Thank you.

 

[tronic]

I have a similar issue with a system not allowing the group owner users to access the admin option in webclient at all. You click Admin and nothing happens.
I used the old admin console to add them to the group owner but then tried via the client and didn't make a difference.
Was fine till the latest release.

 

[SteveITS]

@tronic Did you disable Console Restrictions?

 

[tronic]

This system has allow console access from anywhere.

 

[tronic]

I just created a new group and user via the webclient and this worked.
So, i think if we recreate the group via webclient then add everything back in, we should be good. Finger crossed

 

[tronic]

Confirmed deleting the Group then readding via webclient admin worked. It must be because i created the group via the Admin console.

 

[tronic]

Group admins can manage any extensions within their group. So if those ring groups are part of the same group as the Group admin then they can manage them.....

Nick,

What happens in this situation where this company has a site in Perth and Melbourne. Different time zones and opening hours.
I was using multiple groups t achieve this.

The one staff member controls both sites and i used to be able to have the same user as an owner of both groups. Now if i do that they can't access the webclient admin area. But I also don't want them to have access to the whole system by giving them system owner/admin rights and access sites that have nothing to do with them.

 

[Dominion-Don]

Nick,

What happens in this situation where this company has a site in Perth and Melbourne. Different time zones and opening hours.
I was using multiple groups t achieve this.

The one staff member controls both sites and i used to be able to have the same user as an owner of both groups. Now if i do that they can't access the webclient admin area. But I also don't want them to have access to the whole system by giving them system owner/admin rights and access sites that have nothing to do with them.

Right now, you would have to make them a member of both groups and you would have to create the items they need access too (IVR, ring group, queue, trunk, etc.) via the webclient and assign it to the group at the time of creation (can change after created). 3CX needs to add the ability to assign a ring group, queue, ivr, trunk, etc. to a group after it is created vs having to re-create and affecting any linked call flow.

 

[tronic]

Right now, you would have to make them a member of both groups and you would have to create the items they need access too (IVR, ring group, queue, trunk, etc.) via the webclient and assign it to the group at the time of creation (can change after created). 3CX needs to add the ability to assign a ring group, queue, ivr, trunk, etc. to a group after it is created vs having to re-create and affecting any linked call flow.

From my testing yesterday this is not the case.

This is a 5-year-old site originally from version 16. Everything was created ion the admin console.

The only thing i did differently to make it work was create the Group from within the webclient admin instead of the old admin console.

Then added all the existing queues, IVR, ring groups etc into that group.

Then the customers managers at site only had access to their applicable group and things i put in there. All was well.

I suggest you have a play with it your self.

 

[Dominion-Don]

From my testing yesterday this is not the case.

This is a 5-year-old site originally from version 16. Everything was created ion the admin console.

The only thing i did differently to make it work was create the Group from within the webclient admin instead of the old admin console.

Then added all the existing queues, IVR, ring groups etc into that group.

Then the customers managers at site only had access to their applicable group and things i put in there. All was well.

I suggest you have a play with it your self.

According to 3CX support, there is no way to add the existing queues, IVR, ring groups etc into the group without re-creating them. If you did not delete and recreate (which is problematic), how did you re-assign existing/legacy ring groups, etc. to a new group created within the webclient? ...I do not see where this is currently possible without re-creating