ictime works with relatively detailed permissions that can be asigned based on JIRA groups. So you can flexibly create the user roles you need.
Please keep in mind that additional JIRA permisions are required to use time tracking ("work on issues" permission; edit & delete work log permissions; http://confluence.atlassian.com/display/JIRA/Managing+Project+Permissions) and time tracking needs to be activated (see http://confluence.atlassian.com/display/JIRA/Configuring+Time+Tracking).