I made a permission scheme from scratch and I get a permission error when I open up a project.

Fahad Akhtar

I created a permission scheme from scratch and where most if not all permissions like browse projects, create issues, add attachments, etc. are granted to site admins, jira-servicedesk-users group, and service desk customer - portal access. The error that shows up reads like the following:

Permission Errors

This service desk project has permission errors that can impact functionality. It says the administrators role is missing a few permissions, same as service desk team, and service desk customer.

These are all project roles. So my question is, am I only suppose to use project roles in permission schemes or can I grant permissions to groups only? And when I click "Fix Permissions" it makes a new permission and names it the same but puts a 1 or 2 depending on which one it was. When it comes to the group I work with, we kind of do not need an administrator or jira-administrator, just users and site admins and customers. Could I give my agents administrator project roles for their respective projects and grant the administrator project role permissions?  

We have around 70 permission schemes and 50 projects so I am trying to clean up. Someone on the community told me I only need one permission scheme for all 50 projects if the permissions are going to be the same for them. Sorry for the long description.  Hope you understand the question, if not please ask for more clarification. Thank you for your help. 

Michael Andolfatto_a62ntx

Hi @Fahad Akhtar ,

I see three main questions, if I'm misunderstanding anything please let me know.

1. What is the proper use of roles & groups? - Service Desk requires certain roles to be added to the scheme as you've noticed, but you don't need to grant these roles to any users. It typically recommended to use project roles over groups because it allows for the project admin to manage access to their project, instead of requiring someone with the jira-administrator permission to edit groups. It's also beneficial because if there are ever differences in who should have access to a project, roles will let you specify who should be added to a certain project, whereas adding a user to a group will grant access for any scheme with that group in it.

 

2. What roles should users have? - A little confused by the wording here, but it sounds like you'd like to know where to assign the Administrator role? It again not necessary to give it to anyone. If you've added a group into the Agent or Administrator permissions, members of these groups will be able to use their functionality. You just lose out on being able to make projects have a unique "staff" as every member of these groups will have the same access/permissions for all projects using the scheme.

 

3. How best to clean up? - That's correct, if all projects should use the same scheme, you only need one. Note: anyone with the jira-administrator permission can edit the access of a permission scheme and if this is done, it will of course affect all projects using it.