nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How can I restrict the Activity Stream on the System Dashboard?

Ken Hymes

We're trying to configure customer access to JIRA, and don't want to display any internal project data. We've got all internal projects secured with a specific internal Permissions Scheme. After setting up the customer accounts, I logged in with one to see what they see. All projects are secured properly; however, I can search for and display the System Dashboard. That wouldn't be so bad, but on the system dashboard is the Activity Stream, showing issues from all projects. Is there a way to restrict the view of the Activity Stream, say, by jira group? Or is there another slick way that I can restict the view our external customers have of the activity stream?

Accepted answers

All comments

Patrick Li

Activity stream should only display issues updates for the issues the logged in user can see. What happens if you click on any of the issues in the activity stream? Do you get a permission error?

Timothy

Well, I believe that the Activity Stream gadget complies to the JIRA permissions so you should be fine. Do they see issues that they are not supposed to see on the gadget?

Ken Hymes

Here's an example of what I can see as an external customer in the Activity Stream:

"Ken Hymes committed changeset 3982 to the DELIRIOUS project"

There are active links to the "3892" code snippet and to the project DELIRIOUS that I can access and view.

These are links/references to our Subversion code repository, which is also linked to issues in JIRA...

Ken Hymes

Yes, Tim, they do see items from projects they shouldn't see...not issues, but code changes, comments, etc. Any way to use Security to rope these off as well?

Ken Hymes

Yes, I do see items (not issues) from 'secured' projects in the Stream and when I click on them I don't get any type of permission error -- for example, a code snippet that was submitted. Yes, I thought I had closed that loop with my Issue Security Scheme, but it doesn't appear to be working. :-(

Patrick Li

So it looks like a mis-configuration with your permission scheme and/or issue security scheme (maybe your issues do not have a security level selected).

Ken Hymes

I don't think so, Patrick, The Permissions and Issue Security seem to only apply to ISSUES, yes? Doesn't seem to account for items related to Bamboo, Crucible, FishEye, Subversion, and Confluence. These are the items I ended up turning 'off' on the Activity Stream so they now don't show up. Do you have a better way to filter those items by a security group?

David at David Simpson Apps

Perhaps you could restrict the Activity Stream gadget to just logged in users. Adding the paratmeter roles-required=use to the end of the activity streams gadget URL should prevent usrs who are not logged in from seeing the gadget.

For other configurations, check out this JIRA: https://jira.atlassian.com/browse/JRA-21505

Ashfaque Siddiq

Is there any update to this? How do you actually apply roles-required=use to a gadget? @David Simpson I know this is a really old issue, but having the exact same problem.

Essentially, our internet hosted JIRA application shows the Activity Stream as it is part of the System Dashboard when a user is logging in. So the before username / password has been entered the Activity Stream shows users updates on Issues and the regular activities as expected. This is fine to show after the user logs in but not before any login info is provided. How do I restrict / stop this?

Diego Salas

What worked for me is restricting the permission for Developer Tools in the Permission Scheme assigned to the project. By default is assigned to all JIRA users. Changed to Project roles.

Szczepan Wilkiewicz

Thank you very much. That's what i was looking for. Hide all activity not related to user project.

Diego Salas

You are welcome. Glad to help

O M

Did not work for me. Removed all permissions from View Development Tools, but any logged user still can see any activity for all projects in Activity Stream.

M Vijay Kumar

Hi Hymes,

Did you fix this issue. I am still facing the issue. Users who don't have access to other projects still see the issues commented etc.,

thanks,

vijay

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

dashboard

activity-stream