nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Can we restrict access to JIRA tickets by watchers and reporters?

DI2E Licensing

We have a JIRA project called simply Accounts. It's used for people to request new accounts. We use JEMH, so most requests are coming in via email and the requestor has no JIRA access. However, sometimes existing JIRA users create account requests.

Currently it's set up so all jira-users are in the "users" role and users can create tickets and see all tickets.

We would like it to work differently. Specifically

Allow any jira-user to create a new ticket and they then have access to it.
Allow us to add watchers (not in the project's developer or admin roles) and those watchers can see that ticket as well.

Is this possible?

Thanks in Advance.

Accepted answers

Svante Gustafsson Björkegren

Hi,

You should check out this plugin: Jira Watcher Field

It adds a new field type that you can use in permisison schemes, Issue Security Schemes etc. It will make it possible to grant various access to watchers on specific tickets.

Make sure everyone can create tickets and that your new watcher field has browse permission, maybe even edit permission if you want them to be able to edit the tickets they are watching.

I am using this plugin for a number of JIRA projects and it works great!

Cheers,

// Svante

All comments

Boris Georgiev [Appfire]

Do you need to add a list of watchers to a specific issue or you just need all users in a watchers group to be able to see any ticket ?

Fabio Racobaldo _Catworkx_

Hello,

you can setup a specific permission scheme for this project. In particular tyou need to setup "Browse issue" permission just to watcher/reporter and project administrator (if you want that administrators can see all the issue within the project).

Create Issue permission should be set as well in order to allow jira-users to create ticket.

Hope this helps.

Fabio

Svante Gustafsson Björkegren

Hi,

You should check out this plugin: Jira Watcher Field

It adds a new field type that you can use in permisison schemes, Issue Security Schemes etc. It will make it possible to grant various access to watchers on specific tickets.

Make sure everyone can create tickets and that your new watcher field has browse permission, maybe even edit permission if you want them to be able to edit the tickets they are watching.

I am using this plugin for a number of JIRA projects and it works great!

Cheers,

// Svante

Julian_j3j898

Hi There,

You can use JIRA Issue Security Level for restriciting user to see the tickets. Since the security level can be bound to the custom field, you could create a "User Picker" custom field and set the security level to refer to the users in that custom field. This will make only the users inside the custom field that are able to see the ticket.

For more details, you could check this documentation:

https://confluence.atlassian.com/display/JIRA/Configuring+Issue-level+Security

Regards, Julian.

DI2E Licensing

I don't see a way to give "Watchers" a specific permission. In "Add New Permission" screen, watchers aren't a group, or a custom field or a role. Maybe I'm missing something.

DI2E Licensing

I want to be able to add watchers on a ticket-by-ticket basis. So your first option: add watchers to specific issues, and those watchers will vary from ticket to ticket.

Boris Georgiev [Appfire]

So in that case what @Svante Gustafssonsuggested seems most relevant

DI2E Licensing

This sounds good. It's not working yet for me so I'm setting this up incorrectly. I installed the plugin. I created the custom field per the documentation. In the relevant permission scheme, I removed "users" from "browse projects". Added user field "Watcher Field" to "browse projects". Tried adding a watcher to an issue and got the error "The user does not have permission to view this issue."

So then I created a new security scheme. (my first so this may be the problem).

Set a security level called "watchers". In that gave roles administrators and developers and custom field "Watcher Field" permissions.

Got the same error when I tried to add a watcher.

Then I left the security scheme in place and gave users browse projects permissions again and still the same error.

The way I'm reading this plugin is it does all the work of putting watchers into the custom field.

Any idea what I'm doing wrong? Thanks in advance.

Boris Georgiev [Appfire]

So my advice is to start over (I mean - just revert the changes in the permission and issue security scheme) and perform the steps in the following sequence:

In the project "Permission Scheme"
1. give administrators and developers "Manage Watcher List" permission
2. give administrators and developers "Set Issue Security" permission
Try if a developer or administrator is able to set values in the watchers field and users can not
Create an "Issue Security Scheme" and add level "watchers"
Add administrators, developers, and watchers field
Test if you're able to set issue security on an issue

I hope I'm not missing something , but the general idea is to test the result on each step , so eventually you can see which exact step you did wrong an then try to figure out this specific problem.

DI2E Licensing

After step 4 and before step 5 do I not need to assign the new issue security scheme to the project in question? I did this, but results aren't correct. My test user, that was a watcher on at least one issue in the project, could not see any issues in the project and could not be added as a watcher (same error as before).

As far as step 5 goes, I'm not actually sure how to do that. https://confluence.atlassian.com/display/JIRA/Configuring+Issue-level+Security does not cover setting the issue security for a single issue. I'm new to using issue security levels, as I'm sure you can tell. This will be cool when I get it to work.

I appreciate your patience with me.

John_Gamble

This is bad, very bad. The moment you add "Browse Permission" to the user custom field value for the "Watchers" field - regardless of whether it has anything assigned to it, suddenly any user in the system can go to the "View All Projects" screen and list all and any project set up in JIRA. That means if you have a client who logs in they can view all of the company's internal projects and know what the company is working on. We therefore can't use the JIRA Watcher Field plugin.

We're using JIRA 6.2.1.

Francesco Tordini

This is exactly our scenario. We need to enable project visibility to users only if they have the correct permission, but when we add the user custom field value "Watchers" to the "Browse Permission", any user in the system gains the "View All Projects". This is very confusing for our users, even if it doesn't brake the correct project mapping for the "Create" functionality.

Now on JIRA 6.4.12, tested also on a JIRA 7.0.5 instance.

Bobby Collins

Does anyone know if this issue still exists? Giving a restricted user 'View all projects' rights seems counter initiative to the whole point of the exercise. Our objective is to restrict a user to viewing a single project on tickets that only exist when the user has been added to the watcher field. I assume this is a bug? Can anyone confirm if this is still the situation?

We are using JIRA v7.3.3

Brian Chabot

@Bobby Collins

I don't believe this is an issue. But JIRA is complex and you have to watch out for it.

We are currently working on only allowing Reporters and Watchers to see the issues they are allowed to see. I'm using this Watchers plugin and I'm getting it to work. Granted Consultants have to use the Edit button to edit the Watchers CF to get it to work. If they use the standard built-in Watchers field they will get an error stating that user to not allowed to be added. (That whole Catch22 that is mentioned above I believe)

My test user, who is locked down, only sees issues where they are a reporter or a watcher of. And I'm bouncing around multiple projects and they see nothing. So, long story, it is possible.

We are not done building this out, but you can do it and I believe I don't have any issues.

we are on 7.7.2

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

watcher

permission