nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Security Issue: users are not part of JSM project but still they are able to browse from create butt

Saqib Dar

Hi,

I am facing an issue with my customer.

He is part of only the application access group not in browse permission of a project still he is able to create tickets from create button in change management project details as below.

Project Type: Service

Project Name: Change Management

Browse Permission: No( not added as single user not added as group)

Part of Global Permission: No

Application Access(Jira Service Management): Yes, (user part of group which only has app license)

Accepted answers

Saqib Dar

@Alex Koxaras -Relational- i got the solution. i go through my permission scheme and see create issue permission.

the create issue permission is granted to Group custom Field Value i.e Assignment group

it includes all groups in the Jira. So, any user which is having JSM license eligible to create issue from create issue button. As I removed this permission it's fixed the issue.

attaching the permission scheme screenshot.

Thanks for your support.

All comments

Joseph Chung Yin

@Saqib Dar -

Are you stating that this customer has access to your project via the project UI? If so, this means he/she has agent license against your JSM env. Can you confirm?

If he/she is just a customer - By default, they can also access your project via the Portal UI.

Please advise.

Best, Joseph Chung Yin

Jira/JSM Functional Lead, Global Infrastructure Applications Team

Viasat Inc.

Saqib Dar

@Joseph Chung Yin

Yes the user has agent license, and it has access through Project UI When the user press create button it shows the project.

they are part of business type project not service.

Please elaborate this point I didn't get (If he/she is just a customer - By default, they can also access your project via the Portal UI)

Thanks.

Regards,

Saqib Dar,

Jira Admin

Alex Koxaras -Relational-

Hi @Saqib Dar

When you create a JSM project, you get certain choices about the customers from the project setting. If your project isn't setup to allow customers added to that specific project:

customer permissions.png

Then the above is connected to the customer access, to which you let Jira know who can become a customer and under which conditions.

customer access.png

Most likely you have setup your JSM project in such a way to allow customer from either an approved domain, or to create their own account.

Saqib Dar

@Alex Koxaras -Relational-

Application Access:

Customer permession:

Business users are neither added to any of service project nor they are part of any other application access group

Saqib Dar

@Alex Koxaras -Relational- i have checked the permission helper to these user are not granted any permission in change management project

Alex Koxaras -Relational-

@Saqib Dar can you also check for any customers inside the project? Check from Customers options on your JSM project, as well as People from project settings (users that have been granted with Service Desk Customer role).

Saqib Dar

@Alex Koxaras -Relational- i got the solution. i go through my permission scheme and see create issue permission.

the create issue permission is granted to Group custom Field Value i.e Assignment group

it includes all groups in the Jira. So, any user which is having JSM license eligible to create issue from create issue button. As I removed this permission it's fixed the issue.

attaching the permission scheme screenshot.

Thanks for your support.

Alex Koxaras -Relational-

@Saqib Dar that's what I told you on my last comment.

And he hasn't as well the create issue permission on that project

Good to know that you've solved it.

Saqib Dar

Thanks for your help mate

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

security

jira-service-management

jira-service-management-server