nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How does exactly issue level security work?

Balázs Bogda

Hi,

I've a customer project that will be handled over to the customer for UAT. It means that I'll invite the customer to join JIRA to execute its tests there. Now, I don't wanna create a new project only for that sole purpose and I also don't want to show them the issues we've worked on until the hand over. I would like to show only the ones that concerns them (are created by their individual users, under the same role).
What is the best way of doing it? Is issue lever security a tool for that?

Thanks in advance,
Balázs

Accepted answers

Nic Brough -Adaptavist-

You can do it with issue security schemes. The most simple way to explain it is an example:

Create a security scheme with these three levels and their settings:

Private. Role A, Role B, Role C
Confidential: Role B, Role C
Classified: Role C

Apply that to a project where Roles A, B, C and D all have "browse project".

On each issue, you can set the security level to "empty", or one of the three I've definied above. Empty means A, B, C and D can see the issue. Private effectively stops D seeing it, Confidential means only B and C, and Classified blocks all but C.

BUT. If you really mean "I only want the Client Reporter and my internal Developers to see an issue", then just set "Browse = Reporter, Role:Developers". You don't need security schemes to do that any more (You used to, or you could use the better option of "reporter browse", but "Browse: Reporter" has been fixed to meet expectations in later versions of Jira)

All comments

Nic Brough -Adaptavist-

You can do it with issue security schemes. The most simple way to explain it is an example:

Create a security scheme with these three levels and their settings:

Private. Role A, Role B, Role C
Confidential: Role B, Role C
Classified: Role C

Apply that to a project where Roles A, B, C and D all have "browse project".

Adrián Plaza [DEISER]

Hi @Balázs Bogda,

Yes, the issue-level security can work fine, you can find all the information about the issue security level here:

https://confluence.atlassian.com/adminjiraserver/configuring-issue-level-security-938847117.html

Regards,

Adrián.

Test_x44luj

Hi Nic Brough [Adaptavist],
thanks for your quick answer. I got to the point where I set up the security levels, but don't know exactly how that works on the issues itself. At the moment, when I create (administrator role, that has permission to Set Issue Security) an issue I don't see this security level field, however on the screen configured for my project, it is on the field tab. How does that work?
Thanks again,
Balázs

Test_x44luj

Hi @Adrián Plaza,
I've seen that documentation and I'm here for the missing part ;-)
Thx, Balázs

Adrián Plaza [DEISER]

Hi @Test,

The Security Level field has been hidden on purpose, please see the limitations of doing so in Hiding or showing a field.

You need to enable/show the field in the field scheme, you can finde more information here: https://confluence.atlassian.com/adminjiraserver073/specifying-field-behavior-861253403.html#SpecifyingFieldBehavior-Hidingorshowingafield

Regards,
Adrián.

Nic Brough -Adaptavist-

The create, edit, view and transition screens are separate entities (although they can be shared). It sounds like you have everything right for "edit" ("level" field on screen, set scurity permission), but it's not on the Create screen.

Go to the project settings and drill down through the "issue type screen scheme" until you land on "create"

Balázs Bogda

Hi Nic,

I'm finally ready with the full set-up. The only missing point was that I forgot to attach the security level scheme to the project itself. I've created it, everything was ready, but this little step was missing
I'm now in full control, migrated the old tickets to have the necessary security level value, created a separate board for the customer and also restricted its right only to that board.
Once again, thank you very much for you support and help.

Kind regards,
Balázs

Balázs Bogda

Hi Andrián,

On my default screen schemes this field was not hidden. I had some difficulties with the set-up itself, but now it has been solved. Thanks for your comments and shared links.

Kind regards,
Balázs

Hartej Arora

Hi everyone,

Sorry for commenting on an old post but I have a couple of questions in regards to how the Issue Security is configured

1) Does the browse project permission override the issue security?

2) Are people with global administrator rights able to bypass issue security?

Thanks & regards,

Nic Brough -Adaptavist-

No problem - your follow-up question is still relevant to the topic.

1) No. It is more the other way around. The "browse project" permission tells us who can see all the issues in a project. Issue security then limits who can see individuals issues (no security level = everyone who has browse project. Security level set = only the people in that security level)

2) Indirectly, they can. There's no way for a global admin to see an issue with a security level set to exclude them. For example, if "top secret" level says "only people in group X can see these issues", then an admin who is not in group X will not see the issue. There's no way for them to find it, it is completely hidden from them. But, as global admins, they could see, and then change or remove the security scheme, or put themselves into group X.

Hartej Arora

Hi @Nic Brough -Adaptavist- ,

Apologies for the delayed response. Thank you for your comment explaining the hierarchy. I was able to get the desired setup.

One follow up, is it possible to add the watcher of a ticket to the governing issue security level?

Thanks!

Nic Brough -Adaptavist-

Yes, but if you want to do it automatically, you will need to code for it.

Scott McDonald_qykakt

This is for all the issue types in one project, correct? Are we able to limit the security to just one issue type?

StephanieC

Im searching for this answer as well... we would prefer to lock down certain issue types in one project so we dont accidentally forget to set issue security just on those issues!

Nic Brough -Adaptavist-

Security levels are set at the project level, not issue type.

Matt Smith

StephanieC I am wanting to do the same for customers not to see a particular Request type (or even Issue type),

Very irritating it cannot be done.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

issue-security