iFrame specific Jira Portolio Scope Report view to Conluence page

[Thompson.Vou]

How do I show a Jira Portfolio Scope Report on a Confluence page with only specific columns showing?

After modifying the Jira Portfolio Scope Report to only show the needed columns, the "Share" > "Embed" iFrame link doesn't retain the column settings. When the link is used in the iFrame macro in Confluence, ALL the columns from the Jira Scope Report show up. Configuring the columns in Jira nor the Confluence page retains that view once the page is refreshed. 

This statement in the documentation is not holding true: "Consumers of the report will get the same view from which the report was shared."  https://confluence.atlassian.com/jiraportfolioserver/sharing-the-reports-857058634.html

[Earl McCutcheon]

Hello,

There was a security update for Clickjacking protection enabled in confluence and Jira that added in a SAMEORIGIN X-Frame and SELF frame-ancestors to the header that causes this feature to be blocked:

• https://jira.atlassian.com/browse/CONFSERVER-29230
• https://jira.atlassian.com/browse/JRASERVER-25143

To get around this you can either fully disable Clickjacking protection noting the Warning in the KB below that this is not recommended unless you have other security measures in place such as an instance that is only accessible behind a solid firewall and no public access:

• Confluence page does not display in an iframe

The other option is to create a list of paths to Exclude the self origin hearer paramaters as covered here:

• Security headers in JIRA

And an exe for portfolio would be:

-Dcom.atlassian.jira.clickjacking.protection.exclude=/secure/PortfolioPermissions.jspa,/secure/PortfolioPortfolioManage.jspa,/secure/TeamManagement.jspa,/secure/PortfolioPlanView.jspa

Regards,
Earl