Help Desk Organization Questions

spiceuser-9ot0g · 2021-05-27T15:12:27.000Z

So I had the users in the user management part but i just had one for a test as we havent set up everything or even know the employees to add just yet.I had one test user try it also but after entering the email at the portal,they then receive a personal email that says a request to log in was sent but doesn’t give a link to anything except an admin portal link.

clutka · 2021-05-27T15:55:26.000Z

Was that user’s email address used to test out Spiceworks (the community) or Spiceworks Cloud Help Desk before? And you can confirm that this user’s email address is not listed in Settings > Employee administration?

The following is what should happen.

2021-05-27_13_42_21-Spiceworks_Portal.png698×461 29 KB

2021-05-27_13_49_00-New_Tab.png700×380 28.8 KB

I can’t add a new picture so I’ll do so in the next message. But do note that if you’re testing this at one machine, cookies will be a problem. Make sure you do everything in private/incognito windows so that the cookies don’t accidentally want to log you, as the administrator, in.

clutka · 2021-05-27T15:59:01.000Z

2021-05-27_13_49_56-Spiceworks_CHD_Test_Lab_Help_Desk.png696×403 33.2 KB

If you’re receiving an email like:

2021-05-27_13_55_58-Login_to_your_help_desk_portal_-clutka_gmail.com-_Gmail.png734×406 21.4 KB

then the account most likely is assigned to another Cloud Help Desk. To check that out, use that email address to log in at https://on.spiceworks.com/ . You’ll need to contact support[at]spiceworks[dot]com to manipulate the account to allow it as a regular user for your particular Spiceworks instance.

spiceuser-9ot0g · 2021-05-27T16:50:48.000Z

Thanks!I figured soemthing was up.it was because the test email i was using was also an Admin.I tried a personal email and it got the link to go to the portal.It looks like the one in your photo.Using this method.it looks like everytime they want to go to the portal,they have to have a confirmation email sent to them.I guess since in this case we arent using AD,the system uses it as a verification for a user to do it,but wanted to know is there a way to take them directly to the portal once they got the original email or will they have to receive an email everytime they want to access the help desk ticket submission page?

clutka · 2021-05-27T17:15:18.000Z

spiceuser-9ot0g:

Thanks!I figured soemthing was up.it was because the test email i was using was also an Admin.I tried a personal email and it got the link to go to the portal.

Wonderful that it’s working.

spiceuser-9ot0g:

it looks like everytime they want to go to the portal,they have to have a confirmation email sent to them.I guess since in this case we arent using AD,the system uses it as a verification for a user to do it,but wanted to know is there a way to take them directly to the portal once they got the original email or will they have to receive an email everytime they want to access the help desk ticket submission page?

Think of the email authorization option as being passwordless. Many companies are doing away with passwords. They’ll send you a link to log in or send you a verification code instead of being authenticated with a password. This is very similar.

AD authentication will ask for the username and password each time from what I understand. Note that it is not SSO. In that sense, it’s not much of a difference with the email authorization. But AD authentication has it’s own challenges. We won’t get into that unless you really do want to use it.

The portal authorization lasts for a set amount of time when using email authentication. I’m unsure how long it truly is. If the end user returns within the timeframe to Spiceworks , then they should go right in. If the cookie/authorization has expired, they’ll be asked for their email address, yada yada yada. So if they’re asked for the email address, yes, they’ve got to follow the email link. If they’re not asked for the email address, they’re already in the portal. Generally speaking, unless you have a really, really annoying user who is checking on tickets every day, all day long and keeping that cookie active, your users will need to fill out their email address, wait for the login link email, and click the link before they’re allowed into the portal.

And you are aware about the limitations of using the guest access allowed option. The users can submit a ticket immediately since there is no authentication, however, notifications will not go to the user (since their ticket is submitted as a generic user with no email address), the user cannot see historical tickets, the user does not have the ability to attach files to the ticket, and the admin/tech must validate the ticket and manually change the user once accepted.

spiceuser-9ot0g · 2021-05-27T17:57:15.000Z

Ah,I see.So looks like they will have to go with the process. In regards to the guest authentication,thanks for the additional info.I was aware that you couldnt attach photos and had to change the info but I didn’t know that they couldnt check on the history and the notifcations wont go to them.I’ll definitely keep that in mind.Thanks so much Mainstrike.You been a real big help.I’m gonna try the setup on my end and reach back if I have anymore questions!

spiceuser-9ot0g · 2021-06-01T14:13:19.000Z

Another quick question for you MAINSTRIKE. So my manager and I were discussing the email authentication method and I had mentioned that the Active Directory option was the only other one besides the email and guest authentication and she wanted to know a little bit more about it. To the best of your knowledge, how would the Active Directory portal authentication process work? I would assume that the group we are supporting would need to have AD installed on their systems already but how would one get the AD userbase integrated into Spiceworks and would the portal verification process be similar to the email or guest process?

clutka · 2021-06-01T14:41:03.000Z

spiceuser-9ot0g:

Another quick question for you MAINSTRIKE. So my manager and I were discussing the email authentication method and I had mentioned that the Active Directory option was the only other one besides the email and guest authentication and she wanted to know a little bit more about it. To the best of your knowledge, how would the Active Directory portal authentication process work? I would assume that the group we are supporting would need to have AD installed on their systems already but how would one get the AD userbase integrated into Spiceworks and would the portal verification process be similar to the email or guest process?

From https://community.spiceworks.com/how_to/164452-integrate-active-directory-with-spiceworks-help-desk-s-user-portal

"Spiceworks Cloud Help Desk & Help Desk Server have a feature which allows admins to restrict access to the User Portal using Active Directory without exposing your AD server to the outside web.

We utilize JSON Web Token (check out JSON Web Token Introduction - jwt.io for more details) to allow you to authorize users within a browser, without exposing your infrastructure to the outside world.

Basically when AD authorization is enabled, a secure token is generated by and stored on the server. When an end user loads your User Portal, the browser makes a request to a specified IIS server. The IIS server then communicates with your Active Directory server (these can be one and the same) and pops up a login window to the end user. When end user provides valid credentials the IIS server will respond with a generated JWT that is validated against Spiceworks Help Desk."

In more simplistic terms, your request for the user portal will be redirected to the IIS server you supply and manage, the username and password will be validated, and the system will redirect and allow you access to your portal at Spiceworks .

There are several components. I do encourage you to read the link at the top of this message. It should give you the prerequisites to using the SWAuth program and mechanism. Basically you need to install a component onto your IIS server.

Note that you do not need to pre-populate your users in Settings > {organization} > User management. The users will be created as they submit tickets via email, portal, or manually by admins/techs. Users are tied to their email address as the unique identifier. No user passwords are stored with Spiceworks.

This is how a typical login will work. The user will navigate to https://myportal.on.spiceworks.com/portal . They will be redirected and shown the following prompt. [Note that the URL is accessible for my internal network only. External connections would receive an error. You could allow Internet connections to pass through to the IIS server – check with your firewall.] Once authenticated, they will see their tickets.

2021-06-01_12_33_51-SWAuth.png800×270 29.5 KB

2021-06-01_12_38_04-Help_Desk.png783×556 41.7 KB

spiceuser-9ot0g · 2021-06-01T15:38:29.000Z

I see.I took a look at the first article and it gave some pretty good info and photos step by step of how to do it. The thing is,and I’ll try to give as much info as I can,I’m wondering if we would be able to do this.See the Help Desk that we are doing is to support specific applications for users from 2 different organizations.Now my manager told me that the organizations do use AD but the thing is we arent in charge of the administration for theyre AD.Since we arent in charge or adminsirtate it, would we still be able to do the process,such as generating the key and the rest of the steps or does the administrator of the AD for the organization have to do it and need access to it to the process?

clutka · 2021-06-01T16:04:52.000Z

spiceuser-9ot0g:

or does the administrator of the AD for the organization have to do it and need access to it to the process?

Since you don’t have access to the client’s Active Directory environment, yes, it would be up to the client to determine if they want to host an IIS server in their environment and install the SWAuth software on that server. I would propose the portal alternatives to the client – 1. no authentication but can only submit, no attachments, and no viewing historical tickets, 2. email authentication where client must wait for a link and click the link before submitting a ticket, and can file attach and see historical tickets or 3. install the software on IIS and be able to use AD username and password combo to submit, file attach, and view historical tickets. If the clients say they’ll go with AD authentication, it would be up to them to provide the IIS server and install the SWAuth software. Honestly, email authentication has the most flexibility. The only caveat is that you’ve got to wait for the email to be received and to click the link to enter. It’s not bad with many other online sites going passwordless and sending an SMS code to your phone to authorize entry. I see this as being ahead of the curve in terms of privacy/security balance.

I know your topic wanted to have one portal for two organizations and I suggested that you can add a custom attribute to separate the organizations. That solution doesn’t work with AD authentication. AD authentication is bound to only one organization. That may affect your decision on what to propose to the clients. If both clients want different authentication methods, you need to have two different portals which means two different organizations. It wouldn’t be so bad… client A gets Spiceworks Portal while client B gets Spiceworks Portal. You as the admin/tech access just on.spiceworks.com and can use ticket views to separate out the clients. Reports for your clients can also be easily managed. If you wanted just one central email address for ticket support, like help@product.com which is accessible by both clients, this would be harder to support in the two organization setup. I have some ideas but it would be cumbersome with the current Spiceworks Cloud Help Desk toolset.

While Spiceworks CHD is attractive because of its price, it does lose to paid solutions in terms of flexibility. I don’t want to detract you from using Spiceworks, however, it does seem that you may be looking for a bit more from a solution and Spiceworks may not be the right fit.

clutka · 2021-06-01T16:15:43.000Z

I thought I’d add a couple screenshots showing a help desk with two organizations. The first image is the settings screen showing the two organizations. Each would have its own user portal settings. The second image shows a ticket coming in and the organization, or in your case, the client, it belongs to. I did click the down arrow so that I, as an admin, could potentially change the organization. Note that the table view also shows the organization so you can create views that limit showing tickets to just the one organization.

2021-06-01_14_10_49-28-test5-_Spiceworks_Help_Desk.png800×462 72 KB

spiceuser-9ot0g · 2021-06-01T17:16:01.000Z

Ah,I see.Yea just wanted to know since they would be administrating it.Now the thing is, since they are in charge of it,my manager and I wouldn’t be able to be administrators as we aren’t in charge of AD for the organization I assume correct?Also,the 2 organization proposition was good,but the only thing is that it would have us making a new URL for the portal and we wanted it to go to one single URL portal,as when we tried it,it stated that the portals can’t have the same URL.

clutka · 2021-06-01T18:03:26.000Z

spiceuser-9ot0g:

Ah,I see.Yea just wanted to know since they would be administrating it.Now the thing is, since they are in charge of it,my manager and I wouldn’t be able to be administrators as we aren’t in charge of AD for the organization I assume correct?Also,the 2 organization proposition was good,but the only thing is that it would have us making a new URL for the portal and we wanted it to go to one single URL portal,as when we tried it,it stated that the portals can’t have the same URL.

Two things here.

“Administering it” means they’d be administering only their IIS/SWAuth portion which is installed on their servers. That has nothing to do with the administrative functions of the Spiceworks Cloud Help Desk which is hosted by Spiceworks. You and your manager would still be administrators for the help desk. You do not log on to the portal. You would be logging into the Spiceworks CHD directly using your Spiceworks accounts. With Active Directory, this option means you MUST have two separate organizations in the Spiceworks CHD, and as noted, two separate portals. I’m assuming Client A is different from Client B. If using a single portal with AD authentication, probably pointing to Client A, you can’t have Client B attempting to authenticate to Client A’s Active Directory. Organization A would have AD pointing to Client A and similarly Organization B would have its portal pointing to the AD system of Client B. There is no fall-back mechanism. A failure results in no access – you won’t be asked for your email address to attempt an email login.
If one portal is the only solution you want for multiple clients, you MUST use either guest access allowed or email authentication for the user portal authentication method. Remove the AD option from your vocabulary. There is no way for the system to split the authentication methods in one organization. Anyone accessing Spiceworks Portal would have to be on the same authentication method.

spiceuser-9ot0g · 2021-06-02T11:04:47.000Z

Understood.You made it much clearer with me for AD. The single user portal URL option was something important to us so it looks like AD might not be the best option for us. It looks like if factoring in all the drawbacks,the email authentication is the best route as the only downside is the email verification everytime.One last question as you’ve been very helpful with this entire topic for me.Do you know if the Desktop version doesnt require an email verification for this method of authentication or any other method or if they are similar?I know you deal with the cloud version so if your not too sure then its ok but just wanted to check to see if you knew anything about the features for the desktop version.

spiceuser-9ot0g · 2021-06-02T11:11:30.000Z

Forgot to include in last post.It looks like in general,if we wanted to make 2 different organizations,we would be require to make a different portal name with both email or guest authentication,so it looks AD would require the same also correct? For a work around,I just had one portal URL,we are gonna use it for both organizations,and I created an attribute that lets them put the organization that they belong to just to categorize it better.

clutka · 2021-06-02T11:21:34.000Z

spiceuser-9ot0g:

Do you know if the Desktop version doesnt require an email verification for this method of authentication or any other method or if they are similar?

You’re right that I deal with the Cloud Help Desk more so than the desktop. That being said, there are two different versions of the desktop version you reference. One is the older, soon to be unsupported Windows version. If you’re thinking of grabbing that version, you’ll need to do that soon because it will be removed from downloading shortly. Spiceworks Inventory Software: Help & Support - Spiceworks I think some of the limitations have to do with security, email connections with Exchange Online and Google, and others. Check out the post here . The other option is to use the virtual machine of Spiceworks, called Spiceworks Help Desk Server. According to the linked article, it’s life may be evaluated as well. So it’s a toss up.

To answer your question, I don’t recall what the options are. It’s been so long and I no longer have a test system up and running to check Spiceworks Desktop and I never really investigated Spiceworks Help Desk Server. You’re welcome to post that question in the Spiceworks Desktop App Support Forum since that forum supports both versions. It’s possible that the older Windows-based Spiceworks Desktop v7.5 did store user passwords but I can’t provide any certainty.

clutka · 2021-06-02T11:43:42.000Z

spiceuser-9ot0g:

Forgot to include in last post.It looks like in general,if we wanted to make 2 different organizations,we would be require to make a different portal name with both email or guest authentication,

Correct. You are asked for the organization code upon registering the organization name.

spiceuser-9ot0g:

so it looks AD would require the same also correct?

AD authentication is linked to the user portal. The user portal is specific to a single organization. So correct. If deciding to use AD authentication in the user portal, you would use organization A’s user portal to connect to client A’s IIS/SWAuth setup. Client B would have to authenticate against something, whether guest, email, or AD, and would require another portal because you can’t be using organization A’s AD, thus requiring another organization.

spiceuser-9ot0g:

For a work around,I just had one portal URL,we are gonna use it for both organizations,and I created an attribute that lets them put the organization that they belong to just to categorize it better.

Yup, that works. Do note that your clients would see each other if you set the custom attribute a required field in the user portal. When a client submits a ticket, they’ll be presented with the drop down for Client A or Client B. If you’re fine with the clients seeing one another and selecting their appropriate client name, you’re all set. If you don’t want them to know about one another, don’t use the custom attribute as a displayed and required field. I would use some rules to set the client automatically. Do note that the rules in the Cloud Help Desk do have some limitations and you’d have to specify users who belong to that organization.

2021-06-02_09_38_20-Spiceworks_Help_Desk.png750×504 21.4 KB

The above shows a custom attribute for a drop-down list but will not be shown in the portal.

2021-06-02_09_37_22-Spiceworks_Help_Desk.png800×589 36.3 KB

A sample rule set that will take a ticket submitted by either Chris Lutka or Christopher Lutka (different email addresses) and set the custom attribute to the correct client. This is where the limitations appear – you need to specify the users. The Created By field allows for “is” and “is not” matches. I would love to see “contains” so that we can add a domain match, but I digress.

spiceuser-9ot0g · 2021-06-02T13:40:15.000Z

Ok.By see,I’m assuming you mean,the users of one organization can see the other organization name when they are selecting their organization from the portal.If so,thats ok as I’ve tailored a dropdown menu for them to select organization A or B so if they that,then thats no problem.

clutka · 2021-06-02T13:52:35.000Z

spiceuser-9ot0g:

Ok.By see,I’m assuming you mean,the users of one organization can see the other organization name when they are selecting their organization from the portal.If so,thats ok as I’ve tailored a dropdown menu for them to select organization A or B so if they that,then thats no problem.

Yes, that’s what I meant.

It now appears you’re all set. Good luck on your project.

Oh, and don’t forget to mark this thread as solved, if it is indeed solved, by awarding a best answer.

spiceuser-9ot0g · 2021-06-02T14:02:55.000Z

Will do.Appreciate all the info.You’ve been a big help!