Seprating admin/internal portal and customer portal /external

Question

At the moment we have Jira Service desk running on premise server internally.

We want to make the Jira service desk customer portal available to the internet so our external customers can create/view issues, without giving access to our internal service desk portal.

So https://jirapublic.domain.com/ will be the customer portal and https://jira.local/ is our internal service desk portal (only available from our internal network)

With security in mind we don’t want our internal service desk portal be accessible from the internet, but only from the intranet.

The only solution we found so far was to open the port of our Jira server for everything and everyone, however this means our internal portal login page is also reachable from the internet.

And that is not what we want.

Cathi Chanslor · Answer

@Jasper - We are looking into a similar solution for our instance. Did you ever have any luck in getting this functional?

Thanks!

Cathi

Jasper_d97mci · Answer

we want to have the login https://jira.local/secure/Dashboard.jspa only accesable form out internal network and our customer portal: https://jira/servicedesk/customer/portal/7 to on https://domain.com/jira or Https://jira.domain.com and accessable form the internet for our customers.

Andrew Laden · Answer

I have not done this, but have few thoughts.

Jira doesn't run a separate port/instance for the ServiceDesk customer portal, so there is no way to do this if you are directly going to make your Jira instance face the internet.

But wouldn't suggest that anyway. You would be better off setting up some sort of proxy (or a Web Application firewall) to relay the communications between the internet and your Jira Server.

All the ServiceDesk Portal URL's start with https://<HOST>/servicedesk/customer so as long as that is the only URL prefix that you allow through the proxy, then you should be ok.

However, Jira itself will probably not like the fact that you will be using 2 different names to access it. It has lots of internal self references that work best if the name matches. You may need to do some additional configuration on your proxy to make this work well.