How do I isolate an existing user from a new project?

Question

Hello,

I'm trying to figure out how to add a new project, but keep some specific user from having access to it. We're using the default software permission scheme and I don't see how to remove "any logged in user" from the "browse projects and issues within them" without ruining access for everyone in our system.

Can someone please advice how I would add a new project and only grant access to specific users (or deny access to other specific users)?

The flow for this seems extremely convoluted. Going to user management and being able select a user, then select check boxes for projects they can view is what I'd expect from a service like this, rather than having to hop around multiple screens and adjusting permissions for everyone...it's all just very unintuitive.

Anyway, any help here would be greatly appreciated.

Thanks.

S. Williams · Answer

Thanks again for the response, Nic. Unfortunately, I still can't figure this out...

I tried removing the "any logged in user" group from the "browse projects" permission and added a role to it instead but, as I expected, that just means no one without that role can view any project or any issues and those with that role can view all projects and all issues.

I'm at a complete loss here and giving up...thanks for your help, everyone.

Hopefully Atlassian will make this a MUCH easier process someday, but for now, I guess we're stuck : /

Nic Brough -Adaptavist- · Answer

It is a bit more layered than that, and the general advice is "do not use groups in permission schemes"

To expand on that, the default set up in JIRA is below.  Most of us change it, as it's a pain in the neck.

* A Permission scheme says "Role: Users" can see the project
* In the project, the group jira-users is in the role of users
* In global permissions, the group jira-users is used to say "these people can log in"

Net effect - anyone who can log in can use the project.  To fix it, remove the global group from the project role, replacing it with either individual users, and/or other groups.

In this case, what you're trying to do is remove access that's been granted by "any logged in user" and narrow it down to known groups.  So you need to remove the generalised stuff and add back groups and individuals that you want to allow access to.

S. Williams · Answer

Thanks for the responses, but I’m still not able to resolve this. Perhaps I’m being foolish and overlooking something entirely, but…Any time I change the “Browse Projects” permission to anything other than “Any Logged in User”, *no one* can see *any* project or issues within them. Even if I were able to get a new group in the “Browse Projects” permission to work, wouldn’t that mean *any* user in that group would be able to view *any* project in the system? I was really expecting this to be as simple as settings>user management> user> then checkboxes or something to select which projects they can view/access. Instead, this seems pretty convoluted and confusing. Am I missing something here? I really need to isolate some clients from seeing other clients’ projects...