nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Why do all users need to be in the Jira users group therefore have access to all projects?

Rich Lovelock

If you create a user, they get assigned to the jira-users group which apparently they have to be part of to log in to the system.

Being part of the Jira users group means the user is then part of the 'users' group across ALL projects. What if you then want to stop the user accessing certain projects? It seems logical to remove them from the users group for the project but you can't - it then removes them from the global Jira-users group meaning the user can no longer log in.

This doesn't seem logical to me?

Accepted answers

All comments

Dieter

jira-users should only be added in exceptional cases to project roles. You should create your own group for each project and add that to the project role uses. or you do not use groups at all and add each user individually in the project role users.

i currently cannot verify it since i don't have OnDemand access but i guess this is because jira-users is in the default project role "users" . If yes, jira-users should be removed from this default project role else each newly created project will contain jira-users in that role and makes the project accessible for everyone that has an accoumt. Hope it's possible on OnDemand to change the default project role members.

Now in the projects that should not be open you should replace jira-users by another group that just contains the users for your projects

Dieter

The default members of project role users can be edited as described here: http://confluence.atlassian.com/display/JIRA/Managing+Project+Roles#ManagingProjectRoles-Specifyingdefaultmembersforaprojectrole

Rich Lovelock

Ok I think that helps, thank you. I'm just reading more about project roles now.

The documentation says:

Jira-users group contains every JIRA user in your system. By default is a member of the 'Users' project role.

So what I need to do is create project roles and groups for each project, assign users accordingly to the groups and this should OVERRIDE the jira-users group permissions that allow all users to access all groups?

(I can't remove users from JIRA-users as they can no longer sign in to JIRA at all, that's in the documentation as well).

Dieter

You don't need to create a new role. just remove jira-users from the role "users" and add your own group to role "users". Do this in all projects where you want to restrict the users. Also change the default members of role users to empty. Thus each newly project will be safe by default. if you want to make it open, add jira-users to role users else create your specific group and add this role

Rich Lovelock

I have a problem I can't solve, not sure if you or anybody can help.

I've created a new project. It has the defaults project roles (admin, developers, users) assigned to it.

I've created a group called TGC with all 4 team members in it and I want them all to be able to administer just this project.

Under the project-role administrator, I've added the TGC group. When logging in as another team member I can see the administer project link for the project and I can access the 'General' tab. If I click any of the other tabs (e.g. Issues or Wiki) I get a log in box and a mesage saying the user doesn't have permissions.

I thought by adding the users to a group and assigning the group to the administrators project role for the project that's all that I'd need to do. What else might be preventing them access to those pages?

Joris Weimar

Did you ever figure out how to have this happen by default without having to remove the jira-users group from the User role for each project?

Oleksandr Chalyi

Go to Permissions schemes -> for Default Permission Scheme (that is used by each new project) open -> Permissions -> remove group "Jira-users" from Permission "Browse Projects".

Ricardo Müller

You have to define in the projects permission scheme who's able to manage a project. If you set the project role to administrators it should work.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

jira-cloud

user-group