What is the relationship between Users, Groups, Project Roles, and Permissions?

Bob_ti4qhl

This question relates to Jira Cloud.

There is a map graphic in the documentation "Jira Permissions Made Simple" that shows a one-to-one relationship between a Project Role and a Permission Scheme; there is also a one-to-one relationship between a Project and a Permission Scheme: a project can have only one Permission Scheme. 

When setting up "External Users", like customers, in order to limit their access, you are required to link a Project Role, "Customers", to a different Permissions Scheme and remove them from "jira-software-users". That approach seems to suggest that a custom Project Role points to the custom Permission Scheme and not the Permission Scheme associated with the project. This seems to contradict the map in "Jira Permissions Made Simple" I reference above. 

What am I missing? What is the relationship between Users, Groups, Project Roles, and Permissions?

Jose M_

I wouldn't say, there is a one-to-one relationship between a Project Role and a Permission Scheme.

My understanding is:
The Permission Scheme defines, what the user should be allowed to do. The user can have the permission through a Role or through a Group he is a member of. You can mix it up. We prefer to work with groups, because in this way we are more flexible.

Basic example:
Project_A, Role Developer is shared with Group_A
User_A1 and User_A2 are in Group_A
Acc. to Permission_Scheme_A both users are allowed to work on Project_A

User A1 is also in Group_S. This group is not listed in the Project but is listed in the Permission_ Scheme_A and defines, who is allowed to change the Security Level.

In Group_S there is also User_B, but User_B is not a member of Group_A, so he is not allowed to see and work on Project_A.

Summarising: You can combine Roles and Groups and define the permissions in the Permssion Scheme. BTW: Using groups to define permissions you can use them also in workflows.

I hope, this was a little bit helpful.