Re-use Project Roles in Jira to control access in Confluence

Question

Hi - Our Jira users happily manage their own team compositions via the Project Roles option, avoiding the need to bother me as Site Admin to move people in & out of their Projects. Given that each of our Projects has its own corresponding Confluence Space, I'd like to be able to use that same list of people they define in a Project to determine who gets access to the corresponding Space. So (eg) we might have 12 people in a Project (in various roles) and I'd like that same 12 people to have access to the Confluence Space they create.

I realise I could do this via a Group (per Project) but that would mean Project Admins would have to come to me to add someone into their Jira project (which would also add them to their Space), which I want to avoid; we like the decentralised approach to user management we currently have.

So is there a way to reference these Project Role in the Security model for a Confluence Space? If not (out of the box) then is this something which would be achievable using Scriptrunner?

Nic Brough -Adaptavist- · Answer

Ok, great, the move to Atlassian Access changes the field somewhat, because if you want to do this by read the contents of Jira roles in a project so you can add people to a group in Confluence, it changes the target of any script you might write.

If you're deciding to do this with a direct "added person to a role that allows edit in Jira, therefore we should add them to the linked space with create/edit permission", then your scripts won't need to point to Access.

And I am out of my depth at this point.  Confluence Cloud does have a REST API that enables the addition of permissions to spaces, but I've never coded for it, in SR or anything else.

I'll see if I can round up someone who can talk about this with you in more detail.

Matthew Bellamy_9nifkf · Answer

Hi Nic. Thanks for answering. We're on Cloud for both Jira and Confluence and are shortly to start using Atlassian Access.

Project roles are great as they allow Project Admins to control their own team compositions, so it would seem sensible surely to carry this same construct over to Confluence, but alas, it seems not possible.

Rgds, Matt.

Nic Brough -Adaptavist- · Answer

Hi @Matthew Bellamy

The very short and unhelpful answer is "no... but".

Confluence does not have roles, so there is no way to do any form of direct mapping, but you may be able to do some indirect mapping that achieves something that works out.

Indirectly, with individual users or groups,  yes, you can, in most cases.  You could use Scriptrunner to write scripts that can read the role/access data for users and update user permissions in another system.

I say "most cases" in there because I am not sure of the systems you have and I'm a lot weaker on some scripting on the different platforms, and I'd like to know what platform(s) you are on before I commit to an answer.

* I know we can do it on Jira/Confluence on Server/DC (because I wrote scripts for it years ago for a client!)
* I am sure we can do it if one system is Atlassian Cloud and the other Server/DC
* I would want to ask an SR guru if both systems are Cloud
* Also, if (one of) the systems are Cloud, are you using Atlassian accounts, Google accounts, or Atlassian Access?