JIRA Users without resolve permission can resolve issues

Question

Hi,

I just discovered a strange situation:

I have a project role called "Observers". This is ment for a kind of restricted users, and they are allowed to also add comments and assign issues.

Their group has only the global permission "JIRA Users", so that they can login. Their Project Role (Observers) is in the permission scheme at:

* Browse Projects,
* Assign Issues,
* View Read-Only Workflow,
* View Voters and Watchers,
* Add Comments,
* Edit Own Comments.

Strangely enough, I tested it with that user, and I was able to resolve issues, close, start progress... in other words do workflow transitions where there were no conditions on project roles or groups.

How can I restrict these users from making workflow transitions without having to put conditions on every transition? And how would I even say that any Project Role may, except the Observers?

Many thanks,

Loredana

Loredana · Answer

Thank you Ramiro. I can use that resolve permission at every transistion, true. It's just a bit of work now, since we have quite a few workflows to edit.

Mizan · Answer

Can this user do a transition where the resolution of the issue is set ? Also check if the user is in the group which has resolve issue project permission

Ramiro P · Answer

It's easier than it seems. In the moment you create a new workflow you can name the status and transitions with whatever name you like and in that way it's impossible for JIRA to know if in a transition it should check what permission. Unless you indicate what permission should check for that transition.

You can do this: Assign the resolve issue permission to all the roles you want to be able to resolve. And then in the transition indicate a Condition for resolve issue permission. That way the role that doesn't have this permission in the scheme won't be able to fire the transition.