Misconfigured permissions are the #1 cause of security and usability issues in GLPI. This guide shows how to correctly configure RBAC for each user profile.
Understanding the permissions model
GLPI uses RBAC (Role-Based Access Control) with 3 dimensions:
- Profile: set of permissions (what the user can do)
- Entity: data scope (what the user can see)
- Interface: Helpdesk (simplified) or Central (full)
A user can have different profiles in different entities. Example: Technician in the "IT" entity, Self-Service in the "HR" entity.
Recommended profiles
Self-Service (end user)
- Interface: Helpdesk
- Can: open tickets, track their own tickets, consult FAQ
- Cannot: view other users' tickets, access assets, view configurations
Technician L1
- Interface: Central
- Can: view and resolve tickets from their group, consult CMDB, use knowledge base
- Cannot: delete tickets, change rules, manage users
Supervisor
- Interface: Central
- Can: everything a Technician can + view tickets from all groups + approve validations + view reports
- Cannot: change global configurations, manage plugins
Administrator
- Interface: Central
- Can: everything a Supervisor can + configuration + rules + entities + profiles
- Cannot: change the Super-Admin profile, mass destructive actions
Configuring permissions
Go to Administration > Profiles and select the profile. Permissions are organized by module:
- Assistance: tickets, follow-ups, tasks, validations
- Assets: computers, monitors, software, etc.
- Management: contracts, suppliers, budgets
- Tools: knowledge base, projects, notes
- Administration: rules, dictionaries, profiles, entities
Each item has CRUD permissions: Create, Read, Update, Delete, plus specific options.
Common pitfalls
- Granting "All" ticket visibility to technicians – they will see tickets from all entities
- Forgetting to test with the Self-Service profile – many bugs only appear in that interface
- Not restricting the interface (Helpdesk vs Central) by profile
Next step
For access control to external systems within GLPI, see the Access Matrix module. For permission auditing, configure access logs and periodic reviews.
