Showing Assets Data in Confluence

[John Black]

I'm trying to show some data from Assets to Confluence users

I gave specific users "Object viewers" permission in the Schema settings

However when they open the confluence page with Assets data they see a message We couldn't find anything matching your search.

When using Assets admin account the page works

Any idea what I'm doing wrong?

Do I need to give these users Assets accounts? I would prefer not to since they only need to access this one Confluence page

[Germán Morales _ Hiera · Accepted solution]

Hi @John Black , good news first: you don't need to give them Assets or JSM accounts. Object viewer is the one Assets role that doesn't consume a Jira Service Management license, and it's built for exactly this, read-only access to the schema's objects from outside Assets, the Confluence macro included. So your approach is right.

The empty result is a permissions mismatch, not a licensing one:

• Cause: object type permissions override the schema role. If any object type in that schema has object type roles assigned to specific people, that type gets restricted to only them, so your schema-level viewers see nothing while your admin account still does.
• Fix: open each object type the macro queries; where object type roles are set, add these users or their group there too, or clear the restriction so the schema-level object viewer applies.

Both the no-license rule and the override behaviour are documented in Atlassian's roles in Assets guide.

[John Black]

Thanks this helped. We did have an object specific permission on one of the objects.

Now we are facing next issue and I'm wondering if it's related to the fact these users don't have a license

In Confluence we use something like this to show the data from Assets

objectType = "Laptop / Tablet" AND object HAVING outboundReferences(objectType = "Program / Department" AND Manager = currentUser())

It works for Admin account, but it doesn't show any object for regular accounts.

When we try to use just 

objectType = "Laptop / Tablet"

It works for the regular users too

We made sure that a user we are checking with is listed in one of the Programs as Manager so there should be data to show

[Germán Morales _ Hiera]

Most likely not the license, @John Black  . Object viewer already gives these users read access without a JSM seat, which your first fix confirmed. What changed is that this query reaches into a second object type: the outboundReferences part filters on Program / Department objects, and a regular user only matches there if they can actually see those Program / Department objects. The plain query works because it stays inside Laptop / Tablet, which they can see; the reference one returns nothing because the Program / Department side is hidden from them, even though they are the Manager. Your admin sees everything, so it resolves for the admin only.

Quick way to confirm: have one of those regular users run just objectType = "Program / Department". If they see nothing, it's object type permissions on that type; grant those users or their group the read role on Program / Department and the reference will start resolving. If they do see it, then the problem is in how currentUser() resolves for that account rather than visibility.

One thing to check on that second case: Manager = currentUser() only matches when Manager is a User attribute type, not a text field. It works for your admin, so it's probably fine, but worth confirming, since a text-based Manager won't match currentUser().

[James Gamble · Accepted solution]

Hola John,

You probably don’t need to give them full Assets or JSM accounts for this.

Since the page works with an Assets admin account but returns “We couldn’t find anything matching your search” for other users, the most likely issue is object-type permissions.

Go into Assets, open the object schema used by the Confluence page, then check the object type that the Confluence macro is pulling from. If that object type has its own roles or restrictions, add the users or their group there as well. Schema-level Object viewer access may not be enough if the object type itself is restricted.

After that, have one of the affected users refresh the Confluence page and test again.

Atlassian’s Assets roles documentation covers Object viewers and object type role behavior here: https://support.atlassian.com/jira-service-management-cloud/docs/manage-roles-for-your-object-schema/.

EDIT: I saw your reply to @Germán Morales _ Hiera. Since `objectType = "Laptop / Tablet"` works for the regular users, I don’t think this is mainly a licensing issue. The issue is probably in the referenced object type used by this part of the AQL:

object HAVING outboundReferences(objectType = "Program / Department" AND Manager = currentUser())

That query needs the user to be able to read the related Program/Department objects, not just the Laptop/Tablet objects. I’d open the Program / Department object type in Assets and check whether it has its own object-type roles or restrictions. If it does, add the same users or group there as well.

I’d also double-check the Manager attribute and make sure the user is selected as an Atlassian user/account value, not typed in as plain text. If `currentUser()` can’t match the value in that Manager field, the query may return nothing even though the user can see the laptop objects.

Thanks,

James