How does JIRA determine issues security level for a user who belongs to multiple security groups?

Question

Hi All,

I am stuck with a concern related to the issue security levels. I have 3 types of users A) Internal users B)  Business Users C) Clients. Internal users are a part of multiple Security Levels - 'Internal', Business and Clients, where in Business Users are a part of Security levels - Business and Clients.

The problem I am facing is that whenever a Business user opens a ticket, it is by default moved to 'Business' Security Level which is blocking the Clients to see the tickets. In such cases, JIRA admins are manually changing the security level to make sure Clients can see the tickets. Even though the Business users are selecting Client security level from the issue create screen, the issue still is opened against Business Security level.

How to change this behavior? Or how does JIRA determine which security level to apply when a user belongs to multiple groups.

Anil Tatipaka · Answer

The user i am connected with is a part of Client role and is a member of both Business and Client Security groups. This user can see both the security levels on the issue create screen. However, irrespective of what level i choose or select none, the issue is opened against Business security level.

Mohamed Benziane · Answer

Are you sure that the user you are connected with is in the security level client ? You can only see the security levels if you are in the group/project role or user that are associated to it.

Example : The security level 'Developer' is associated with the project role "Software developer", if you are not in this role you will not be able to use this security level.

Anil Tatipaka · Answer

@Mohamed Benziane  - Thanks for the suggestion, but this solution will not work based on the current design.

We have multiple Security Levels and cannot set any of them as default. On the create screen page, when I (as a business user) choose one of the available security levels, it is only picking up the 'Business' role.

Also, there is nothing defined in Post Scripts for setting the roles.