What is the optimal way to create a read-only global user?

[Harold Alcalde]

I need to have a read-only global role for an external user who needs to see all my JIRA projects, is there a simple way to do this?

[John Funk]

Hi Harold,

I would suggest you create a project role for that - maybe even call it Read Only. Then update your Permission Schemes that need to provide access to grant that Project role to Browse Projects. Then add that user to the new project role in all of the projects that they need access to. 

However, make sure your Permission Schemes do not have open access to Any Logged In User or Public or something like that. Otherwise the user will have access to all of those projects. 

[Philipp Sendek]

Hi @Harold Alcalde ,

the best answer might differ depending on how you're using project roles. If you want to make the solution as bullet proof as possible, I would propose the following:
- Create a group called "Global_Read_Only_Access" or something similar.
- Add the user account to this group.
- Add the group to all read only permissions in all permission schemes. (such as "Browse Projects", "View Read-only Workflow" and maybe others)

This way, you would ensure that every new project - as long as it's not using a new permission scheme - automatically inherits this permission and is viewable for this user account.

Obviously, if you strive for only using Project Roles in permission schemes, this would be an undesired exception. But I still consider this the best approach.

If you're interested in a different approach, here would be one using a Read Only project role:
- Create a group called "Global_Read_Only_Access" or something similar.
- Add the user account to this group.
- Add the group into the Read Only project role of every project. (or create the project role if it doesn't exist)
- Make sure the project role has all required permissions in the permission scheme (such as "Browse Projects", "View Read-Only Workflow" and maybe others.)

One certain downside of this implementation is that any project admin could remove the person from the project role in their individual project.

I hope this helps. :-)

P.S.: If you're wondering why I'm proposing to use a group, here are some reasons:
1) When you've done it once, chances are that there will be other users you need to do it for. Using a group right from the start saves you the effort for additional users lateron.
2) A group name can give clear cues of it's purpose. If you'd use a user account directly, project admins might wonder why this person has access to their project and might remove it.

Greetings
Philipp

[Harold Alcalde]

Okay, thanks for the clarification!

Greetings