nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

View only own issues - Issue Security scheme set

Ruud Hoogeveen

Hi,

I've set an issue security scheme so that only the Reporter and Assignee are able to view an issue.
Still a customer is able to view the whole organization's issues.

This shouldn't be a big issue to solve I assume, but it's not working the way I want it to work.

Users only needs to be able to access their own issues through the customer portal.

Also, the automatic new requests automatically be shared with a customer's organization is also turned off already.

Kind regards,

Accepted answers

All comments

Trudy P Claspill

Hello @Ruud Hoogeveen

Welcome to the Atlassian community.

Can you confirm that you applied the Security Scheme to the same Jira Service Management project the customer accesses?

How is your customer viewing the issues? Is that through the portal?

Is the customer listed as a Request Participant on all the issues?

Ruud Hoogeveen

Hi @Trudy P Claspill

Thanks for getting back to me.

They are only allowed to use the customer portal.
Within the customer portal we want to arrange this access where they are only able to view their own issues, and not the whole organization's issues.

The Security Scheme is applied to our two most popular projects to see whether this worked.
It seems to be that the Security Scheme is affecting the Project itself instead of the Customer Portal.
Could that be the case?

It seems that whenever I only added the Reporter and Assignee to the SS, I was unable to view certain issues (2 out of the 12).
I was still able to view other issues where I was NOT either Reporter or Assignee.
This was also raising some concern.

The customer is not listed as Request Participant as that was also not an option within the Security levels. Ofcourse, there is a possibility to create a custom field for that.

Do you need more information?

Kind regards,
Ruud Hoogeveen

Trudy P Claspill

I believe (but have not fully tested) that the Security Schemes apply only to licensed Jira users and Jira Service Management agents/team members who are viewing the issues through the Jira UI. I don't believe that the Security Schemes apply when issues are viewed through the Service Management portal.

For people who are only Customers of your service management project and only using the Portal to view issues, the issues they can view should be governed by:

1. They are the Reporter

2. They are an explicit Request Participant

3. The settings that govern if a Customer in an Organization can see all the issues associated with their Organization.

When you say "I was still able to view...", were you using an identity that is a licensed Jira Service Management user with the Service Desk Team Member role? Were you viewing the issues through the Portal or directly in Jira? How were you finding the issues that you were trying to view.

This article may help you understand the application of the Permission Scheme in Service Management projects.

https://support.atlassian.com/jira-cloud-administration/docs/customize-jira-service-management-permissions/

And this is the home page for information about Customer permissions:

https://support.atlassian.com/jira-service-management-cloud/docs/customer-permissions-for-your-service-project-and-jira-site/

Ruud Hoogeveen

Hi Trudy,

I do agree and noticed that the Security Scheme apply to the Jira UI.
I have checked and tested to change several levels of security to the issues and saw several issues dissapear within the UI.

I'm the most interested in point 3. As it seems now, we have one organization with every customer in it who has registered through our customer portal. They are able to view every issue within our organization.

We are not planning to create more organizations as that would result into an organization for every single customer we have.
We could also create a organization for each team but that's still not ideal.

When I was still able to view, I was indeed a licensed Jira SM user/admin with the Org admin permissions (I assume I should be able to view everything, at any time).

As soon as I added (besides Current Assignee and Reporter) a group I was in, I was able to view the two extra issues we had in our project.
However, out of the nine other issues we had, I was only assigned or reported two or three issues.
So I expect that with only Current Assignee and Reporter added to the Security Levels, I was only able to view those three issues. But I could see nine. Even thought I had no association with those issues.

Unfortunately, those articles about Customer permissions seems to be about creating accounts, mostly.
I will look into it further, but I'm not sure if I will find more.

Kind regards,
Ruud Hoogeveen

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

jira-service-management-cloud

jira-service-management