nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

What is "applicationRole" in Permission Schemes?

Mykenna Cepek

When I use call the Jira REST API for PermissionScheme like so:

https://jira.xyz.com/rest/api/latest/permissionscheme?expand=permissions

...some of the results look like this:

{ "id": 11671,
  "self": "https://jira.xyz.com/rest/api/2/permissionscheme/10200/permission/11671",
  "holder":
  { "type": "applicationRole"
  },
  "permission": "DELETE_OWN_COMMENTS"
},

What is "applicationRole"?

Other results in that same API response make sense, like these;

{ "id": 12298,
  "self": "https://jira.xyz.com/rest/api/2/permissionscheme/0/permission/12298",
  "holder":
  { "type": "projectRole",
    "parameter": "10001",
    "expand": "projectRole"
  },
  "permission": "EDIT_OWN_WORKLOGS"
},
{ "id": 12299,
  "self": "https://jira.xyz.com/rest/api/2/permissionscheme/0/permission/12299",
  "holder":
  { "type": "group",
    "parameter": "jira-administrators",
    "expand": "group"
  },
  "permission": "DELETE_ALL_COMMENTS"
},

The first one indicates a permission granted to specific Roles for a Project.

The second one shows a permission granted to a specific Jira user Group.

I also see "holders" with only a "type" of "assignee" or "projectLead", and those are pretty self explanatory.

But what is "applicationRole"?

Accepted answers

Hana Kučerová

Hi @Mykenna Cepek ,

permission can be granted to Application access - there are options

Any logged in user
Jira Service Management
Jira Software

In your case applicationRole = Any logged in user as there are no additional parameters

All comments

Nicolas Grossi

@Mykenna Cepek You might take a look at the API spec: https://docs.atlassian.com/software/jira/docs/api/7.2.1/com/atlassian/jira/application/ApplicationRole.html

HTH

Nicolas

Hana Kučerová

Hi @Mykenna Cepek ,

permission can be granted to Application access - there are options

Any logged in user
Jira Service Management
Jira Software

In your case applicationRole = Any logged in user as there are no additional parameters

Mykenna Cepek

So are you saying that "applicationRole" with no additional parameters is the same as "anyone" or "group=jira-software-users"? If not, then please clarify. I'm not understanding "granted to Application access ... [with] options".

In my example above, the question is "who in Jira has access to DELETE_OWN_COMMENTS?" -- and "Jira Software" as an "applicationRole" doesn't seem to answer that question.

Mykenna Cepek

That API description says (only):

Represents an Application Role in JIRA. An application role defines which users (indirectly through groups) can access an application.

An ApplicationRole is defined by a JIRA plugin through it's module configuration. An ApplicationRole is regarded as licensed when there is a (potentially exceeded) license present in JIRA that provides user seats for the ApplicationRole that is uniquely identified by an ApplicationKey.

The context of my question is "applicationRole" as a value in a Permission Scheme element. The JSON from the Jira REST API (above) intends to tell me who (precisely) has access to DELETE_OWN_COMMENTS. I want to know what users can perform that action.

The JSON shows only that "ApplicationRole" is specified, no users or groups are specified or even which application. I'm not seeing how this API documentation helps clarify my original question.

Hana Kučerová

@Mykenna Cepek

When you want to add permission to some permission scheme, you can select item "Application access" and there is select field with the options I mentioned before.

So, I'm saying that "applicationRole" with no additional parameters means "Any logged in user" = user with any license (both JSM agents and JSW users, but not JSM customers).

For example if you have both JSM and JSW installed, then all the users with any license (JSW OR JSM OR both).

If you have only JSW installed, then it is the same as Application access with option Jira Sofware - all the users with the JSW license.

It depends on how Jira's application access is configured, it doesn't neccessary means group jira-software-users. There can be other/different groups, which adds users the product license.

Mykenna Cepek

So it sounds like a Permission granted to "Application access" will be granted to all users of the related application (the one listed, or if none is listed the application being used, Jira Software in my original post).

It also doesn't sound necessary, if a Permission Scheme is being carefully crafted to use Groups and Roles. To me it sounds like it was a convenience to leverage the default Group for an application, so that new installs and noob admins didn't lose access early in their use of the new product.

More Server/Data Center documentation, if you too want to go down the rabbit hole:

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

rest-api

jira-data-center

permission

data-center

permission-scheme