I wanted to create a read-only user for our on-demand JIRA (v7.0.9) in order to login as this user during our morning stand up meetings. This avoids anyone accidentally making changes during these meetings. I attempted to create this read-only user as follows: * Created a group named readers * Added this group to Applications -> Application access * Created a permissions scheme named Readers in Issues -> Permission schemes * Assigned the following permission to this scheme: Browse Projects , View Read-Only Workflow , View Voters and Watchers * Created the read-only user and added them to the new readers group * Removed this new user from the jira-software-users group Once I did this, I successfully logged-in as the new read-only user and navigated to the Active sprints view of our JIRA Board. This displayed all the stories / sub-tasks as expected. However, I was still able to move sub-tasks from one swim lane to another, edit sub-tasks, etc. Have I missed some fundamental step here or is what I want just not possible at all in JIRA?

@Robert Pattay: you are right. My JIRA instance lately behaved "strange", people who are put to isolated group started seeing other projects, and could create tasks in other projects (but not browse them). I compared an old project with a new project, with a permission I never modified after creating a project. Old: Assign Issues Ability to assign issues to other people. * Project Role (Developers) * Project Role (atlassian-addons-project-access) New: Assign Issues Ability to assign issues to other people. * Application access (Any logged in user) * Project Role (atlassian-addons-project-access) The difference is there. Both projects are the "Software" type, which means the default permissions have been changed by Atlassian between the old and new projects. The Permission Helper shows this as well. (that those isolated people are able to do certain tasks because of the "Application access (Any logged in user)" permission.

Robert - your suggestion seems to make a lot sense. I will try it out and let you know if it worked. Thanks.

Not sure if the original poster is still watching, but any Permission listed with 'Application Role (Any logged in user)' will allow the users in Group (readers) to do that action. I got around this by making two new groups: ReadOnly and ReadWrite and putting all my users into one or the other. Then I changed all the Permissions that had 'Application Role (Any logged in user)' to 'Group (ReadWrite)' to filter out all the users in group ReadOnly.

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Having trouble creating a read-only user for JIRA

Anjum Naseer1

I wanted to create a read-only user for our on-demand JIRA (v7.0.9) in order to login as this user during our morning stand up meetings. This avoids anyone accidentally making changes during these meetings.

I attempted to create this read-only user as follows:

Created a group named readers
Added this group to Applications -> Application access
Created a permissions scheme named Readers in Issues -> Permission schemes
Assigned the following permission to this scheme: Browse Projects <Group (readers)>, View Read-Only Workflow<Group (readers)>, View Voters and Watchers<Group (readers)>
Created the read-only user and added them to the new readers group
Removed this new user from the jira-software-users group

Once I did this, I successfully logged-in as the new read-only user and navigated to the Active sprints view of our JIRA Board. This displayed all the stories / sub-tasks as expected. However, I was still able to move sub-tasks from one swim lane to another, edit sub-tasks, etc.

Have I missed some fundamental step here or is what I want just not possible at all in JIRA?

Accepted answers

All comments

Nic Brough -Adaptavist-

Check all the groups and roles this user has against the permission scheme - they're somehow getting the JIRA permissions for "transition" and "edit" on the issue in the project. You have probably put them in a "can log in" group (so they can log in) and that group is in a role that allows for transition and edit.

Anjum Naseer1

Is there a way to easily see the effective permissions of a user?

As I indicated above I created this new user and have ensured that they belong to just the new group that I created named readers. I also created a new permissions scheme that has no edit rights at all.

Nic Brough -Adaptavist-

So how are they able to log in?

Anjum Naseer1

They are able to log in because of the first two steps I did above:

Created a group named readers
Added this group to Applications -> Application access

The second step is the one I believe that gives them login access.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

jira-software

jira-administration