How can I block users from accessing JIRA during maintenance, and still have administrative access?
well, I would use e.g. Apache as a fronting web server. Then you could configure rules on Apache or even network interfaces (firewall) levels which allow only given IPs (that's the admin computers) to access it.
You could also have JIRA exposed on a few interfaces (Tomcat connectors) and make one known (and even physically accessible with network rules) just to admins.
With Apache you could probably easily configure an additional password protection for whole realm which only when given would let in traffic to fronted JIRA instance.
Finally you could termporarily deprive jira-users from logging in to JIRA by modyfing Global Permissions ("JIRA Users"). But then rememember to leave to yourself such rights. That would not prevent anonymous access though.
Thank you. I choose to follow your last suggestion, as it is the easiest to implement quickly.
For others needing a quick guide to this, go to "Administration > Users > Global Permissions", to the line "JIRA Users", and [Delete] all groups (first making a note of them all, so as to restore the permission after the maintenance is completed).
Any users or groups with the "JIRA System Administrators" and/or "JIRA Administrators" permission (on this same page) will still be able to login. I am assuming that I will coordinate the maintenance period with any other users in these groups to avoid any conflicts.
After maintenance is completed, [Add] the Permission "JIRA Users" to the groups you noted earlier.
ciao - John.
Here's a country simple recipe from out in Oklahoma for maintenance:
I do it this way because of multiple, overlapping goals of "fall back" and "might be extended maintenance", etc. Also, in the Apache example (Confluence/JIRA running on non-80 port) where the Apache is proxying, just shutdown the Apache. G.
The Apache way might not be the easiest to implement but it's by far the best. Removing global permissions will lead to permission denied error messages and disconcerted users.
I like the Apache way too because you can give folks a pacifier page.
This is very similar to the method that I use as well, although I don't usually have a need to change the base url, just the port number.
We have AD-sync and I've just disabled the directory. Normal users but the admin have no access anymore. Bevor maintain your system make sure there is no open session (system - security - user sessions).
We have Jira Software and Service Desk. Just system administrators are in Jira internal directory. Agents, customers and "normal" software users are defined with AD-sync. So disabling synced directories stops access for everyone except Jira administrators.I think is a quite good approach if you meet this sceneario, because you don't have to involve other administrators (servers, networking, ...) of your organization. It's also quick and simple.
It looks like you're new here. Sign in or register to get started.
