New standard permission schema for Jira Software (Kanban)

Michael Schlueter (secunet)

Recently we did the update to Jira Software 7.4.2. Afterwards I created a new "Kanban software development" project. I used the project settings for "user and roles" to assign certain user to that project.  
So far, all new Jira projects automatically used the "standardpermissionschema" which assigns permission based on the roles "user, developer and administrator". We use this schema for almost all projects.
I was very surprised (not in a positive way) that there's a new default permission schema now , the "standardsoftwareschema". This schema opens the entire project for all users regardless of the project role. WTF?
It's not difficult to assign the old standard schema to the new project, once we know it. But I don't understand the reason behind this new behaviour.
Did I miss something. How is this supposed to work?
Michael

Andy Heinzer

Hi Michael,

What version of JIRA did you upgrade from?  I don't believe what you have mentioned so far is anything new to JIRA in this version or even past versions I can recall.

By default JIRA will use this default permission scheme on any newly created projects only.  If you upgraded your JIRA instance, it will retain your previous applied permission schemes for existing projects.

I believe this default permission scheme is to help simply access to the content in these new projects.  This tends to be helpful to new users of JIRA (especially new JIRA admins) that do not yet have experience in modifying permission schemes yet in JIRA. 

By default in this permission scheme you have already noticed that several permission sections such as Browse issue, create issue, and edit issue are open to "Any Logged in user" to JIRA.  But you will notice that admin functions such as Administer Projects, Delete issues, and Modify reporter are only set to allow for the project role of Administrators by default. 

So the scheme is not completly devoid of project roles.  But when you create a new project in JIRA, you will notice that JIRA does not presume to define project roles for a new project. (unless of course you used the create project with sample data option)   Since the project creation is not creating any project role other than Administrators, it doesn't make sense that the permission scheme in use to start for that project would try to define limits for roles that don't yet exist there.