What I am trying to accomplish is the following:
I have created two classes of services: UnityAccountSupport and UnityAdministrators
The UnityAccountSupport Class of Service needs to have the ability to read, edit, add and delete subscribers.
The UnityAdministrators needs to have full control over all unity operations.
The issue I am having is this:
If I give all the above stated permissions to the UnityAccountSupport COS, they then have the ability to change their personal or anyone else’s class of service and escalate their privileges from “UnityAccountSupport” to “UnityAdministrators” very easily.
However, if I remove the ADD ability from this class of service, they can no longer change the class of service on any subscriber account.
The purpose of the account creation as these users need the ability to complete the functions stated above.
I have spoken with Cisco TAC, and they stated a feature request is the next process to solving this issue.
Has anyone ran across this situation before and can give some guidance.
Thanks
