nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Issue security level flagged as wrong even when not necessary

Giorgio Crosali

I have an external team ("Community Villa" below) unable to access the issue type they are supposed to be able to see:

QN1oHpA

Basically, Community Villa is supposed to have access only to a certain type of issues (called "Content idea").

I've set the security scheme by putting our employee group as default Security Level field, so every task that has that field automatically prevents Community Villa from entering.

However, Content idea issue types don't have the Security Level field:

uhhlNSa

Project permission for their group to browse the project is active. Therefore, the alert makes no sense to me, seems more like a bug (especially because they seem to be able to access other tasks of the same type).

Accepted answers

All comments

Nic Brough -Adaptavist-

The isssue you are looking at has a "security level" set on it. Community Villa is not named in the level as someone who has access to the issue.

It's not a bug, you've just hidden the issue from them with issue security.

Either change the security level on the issue to one that does include the user, or amend the security scheme so that it includes the user in the level

Dirk Ronsmans

Most likely the security is set as Default? So that applies to all then.

Even if the field is not on the screen that doesn't mean it isn't applied. It is just not shown on the screen. On the issue level tho it will still be there (just not visible)

Giorgio Crosali

But why? The security level field is not even enabled on the issue screen, which (to my understanding) should mean there's no security level required for that type of issue. And even if that was the case, that doesn't explain how is it possible that only this one task is not accessible by them while other of the same type are.

Nic Brough -Adaptavist-

The screen definition is simply what fields are presented to a user when they take a particular action (create, edit, view, or transition)

It does not matter whether you have "level" on the screen or not.

For this issue, someone has set a level, I'd guess at a time when level was available on screen, or it may have been set by a script or automation.

However it got set is not the point here though. The fact is that it has been set on this issue, and Community Villa is not named in the level so they can't see the issue.

So, either change the level to include Community Villa, or change (or remove) the level - to do that you may need to (temporarily) add the security level back on to the edit screen and then have someone who is in the current level to edit it.

Nic Brough -Adaptavist-

Ack, sorry, not quite the right answer, Community Villa is not supposed to be seeing the issue, so you don't want to include them in the security.

However, the principle about where the security level applies is the same. You have two things in the permissions analysis - first Community Villa is not in the security level, and second, they also do not have permission to see the project.

So, you need to do two things:

1. Grant Community Villa the right to see the project

2. Have another look at the security level - the scheme is applied at a *project* level and it does not matter whether the field is on the screen or not. If a security scheme is associated, it applies to all issues in the project, the screen is irrelevant.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

jira-software

jira-software-cloud