Limiting Issues to only browse issues they report or added as a watcher

[Steven Hoong]

I have set up a new project for company budget approvals. Everyone is able to view it and open tickets, however, I only want the reporter and watchers to view the tickets they are on. I have set up a permission scheme and followed this guide, https://confluence.atlassian.com/jirakb/how-to-limit-user-to-only-browse-issues-assigned-to-or-reported-by-them-779160753.html, but all users are still able to view all of my test tickets.

[Angélica Luz]

Hi Steven,

Just complementing Andrew's suggestion, if you don't want to use issue security, you can use the workaround provided in the article below:

- How to allow a user to see specific tickets w/o issue security

In this case on every ticket the assignee, for example, will have to add the person that they want to see the tickets.

Regards,
Angélica

[Steven Hoong]

Hi Angelica,

I like this approach better. I will give this a shot and let you know.

[Steven Hoong]

Will the space admins still be able to view all of the tickets?

[Angélica Luz]

Hi Steven,

If they have a service desk license and they are administrators/service desk team, they will be able to see the tickets normally.

Regards,
Angélica

[Andy Heinzer]

The permissions scheme will need to be setup to allow these users to view these issues first.  It sounds like you have that part setup correctly if they can see all of these.  The ability to restrict specific issues in a project like this is handled by issue level security.

Not only will you need to define at least one security level (say that only grants access to reporters/watchers/etc), but then you also need to make sure that all the issues in that project then have the appropriate security level set for them.

By default the security field might not appear on the issue detail view, so you might have to add this to the screen first.  Once you do this field is unique because it always appear in a red font to help indicate the specific security level is applied to this issue.

[Steven Hoong]

how do i do this

"then you also need to make sure that all the issues in that project then have the appropriate security level set for them."?? I followed the same guide that you posted but everyone is still able to view all tickets.

[Steven Hoong]

This is what I have

[Andy Heinzer]

Ok, I understand you have a security level called View, that only allows the current assignee and reporter to view the issue.  However if your test users can still see issues where they are neither of these roles it means that these specific Jira issues don't have this security level set on them.

By default, issues in Jira don't have any security level.   Which means that there is no restriction on them.  Just because you have created this level does not mean that your issues have been assigned this (or any other) security level.  

Essentially, you need to make sure that the issues in question are set with the appropriate security level.   In some cases, admins will set the security level field to be required in order to force users that create issues to select a security level when the issue is created.  By doing this you can be sure that all issues in the project(s) that use that field configuration scheme will be forced to set a security level.

I'd recommend that you go to one of these issues in question that this test user can see and you don't want them to see, and then use the Field Helper in order to search for the 'security level'.   This field will need to be on the screens of this issue so that users can see/edit the security level of the issue.    All the issues you want to hide from these users will need to set a value for that field on them.