How can I prevent users except for those in specific groups from creating a specific issue type?

Question

I am looking for a way to restrict the creation of one issue type (available across all projects) to members of only one Active Directory group.

From other threads, it looks like the best option may be to write a groovy script validator on the Create action that checks the user's group membership before creating the issue. Two questions:

1) Is there a way to hide the issue type from the dropdown so that users not in that one group can't even see it as an option?

2) If not and the workflow validator is the best mechanism, can you provide sample code for achieving this? I am just learning Java and Groovy, and this is the first script I would be writing. This is what I have so far (which runs successfully, but I'm not sure if it will achieve what I want. :)  ):

import com.atlassian.jira.component.ComponentAccessor

def groupManager = ComponentAccessor.getGroupManager()

groupManager.isUserInGroup(issue.reporter?.name, '<groupname>')

Thanks!

Payne · Answer

If you have ScriptRunner installed (I'm guessing you may since you mention scripting), you can user a Behaviour to limit what is shown in the Issue Type dropdown when creating an issue. Here's documentation on doing so for project (not AD) groups, but I tend to think it wouldn't be too hard to adapt it to reference AD groups. We use a variation on this approach, and it works nicely.

https://scriptrunner.adaptavist.com/latest/jira/recipes/behaviours/restricting-issue-types.html

Abby Domanowski · Answer

Thanks, Antoine! Appreciate the help.

Antoine Berry · Answer

Hi,

* I am pretty sure this issue has been discussed a lot and unfortunately this is not possible, unless using workarounds (you should use them only if absolutely necessary imo).
* You are on the right track ! See this snippet :

import com.atlassian.jira.component.ComponentAccessor
import com.opensymphony.workflow.InvalidInputException

def authenticationContext = ComponentAccessor.getJiraAuthenticationContext()
def currentUser = authenticationContext.getLoggedInUser()

def groupManager = ComponentAccessor.getGroupManager()
String groupName = "Your-group-name"

if (!groupManager.getUsersInGroup(groupName).contains(currentUser)) {
InvalidInputException userErrorMsg = new InvalidInputException()
userErrorMsg.addError("Users from your group are not allowed to use issue type.")
throw userErrorMsg
}

(you cannot use the reporter since the issue is not created yet).

Antoine