nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Issues viewable by Reporter only but commentable by everyone?

Julian Emmerling

Hi everyone,

I am currently struggling with a permission/issue security issue I can't wrap my head around.

We want to restrict the issues in our project to only be viewed by the reporter. I was able to easily configure that with a new issue securty scheme which only grants permissions to our service desk team and the reporter.

issue security scheme.PNG

However what happens with that configuration is that another customer (same Organization) is not able to comment on an issue when he is not the reporter (comments via email). The following message is found in the processing log:

processing log.PNG

Additionally when I use the permission helper in the issue it complains that the user that can't comment is not member of my security scheme.

I know I can edit the issue security scheme to add another role or group to it and grant the customer the permission this way. However if I do that the customer can see all issues of his organization, which we want to prevent.

Accepted answers

All comments

Vasiliy Zverev

Issue sequrity scheme allows to set visibility on each issue into a project/

If you want to grant permission for all project it is better to use permission scheme and permission for browse project.

Julian Emmerling

I see.

How would I set up the permissions so only the reporter can view his issues and everyone can comment?

Also how would I go about further granting/restriction permissions for single organizations? I need the possibility to grant managers of the customer also permission to view the issue. Would I do that with the issue security schemes or the permission scheme?

Vasiliy Zverev

Is it good idea to allow comment issues, but not view it?

Set view permission for organisations could be implemented with sequrity schema. Create a group for each organisation and sequrity level. Add each group to each sequrity level. Then for each issue you should set respective sequrit level.

Julian Emmerling

Well, ideally the reporter and the request participants can view the issue. Using securtiy schemes it was not possible to add request participants so we decided to do only the reporter. Maybe thats possible with permissions?

We need everyone to comment via mail (for obvious reasons) but not be able to browse the issue for compliance reasons - that should be reserved for managers in the future.

Danyal Iqbal

Use permission scheme . Security levels should be used to manage partner accounts or customer accounts with multiple users.

Georg Karner

I tried to do that, but I ran into issues.

For my case I would need to remove "Service Desk customer - portal access" from the Browse Projects permission. However, as soon as I do that JIRA complains about permission errors that need to be fixed (cannot dismiss) and functionality gets impacted.

I tried again with the issue security scheme in a dummy project and it works as expected there. This leads me to believe the error im getting in the processing log is solveable somehow.

What I also noticed in our productive project with the problematic security scheme enabled:

Comments via email from non-reporters on an issue get declined with the error in my screenshot (no permission to view attachement), but attachements sent with the email still get attached to the issue.

Meanwhile Atlassian advised me to disable the "cr-share-request" module - I will try that but I'm not sure what functionality this will impact.

Julian Emmerling

whoops, logged in with the wrong account - thats my reply

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

jira-service-desk

permission

security