How can I create an 'Observer' permission scheme for a single project?

[Tristan Latour]

Hi all,

I've been search the forums for an answer for some time now, but I can't seem to find what I'm looking for. Here's the issue at hand, hopefully you can help me!

We are currently working on a few active projects in JIRA, one of which is Project ABC for Customer XYZ. Since this customer wants to keep an eye on the development, she wants to be able to view the sprint plannings and our backlog for Project ABC. Note: since the customer isn't technical at all, she wants to make sure that she cannot edit or change any of the issues, she only wants to have viewing rights, simply to be able to monitor our progress. 

I tried to create a Permission Scheme linked to Project ABC which only allow to browse the project, but after I link the project to this very limited Permission Scheme, our developers seem to be unable to touch the project. when I create an observer role, this observer has access rights to all our other projects too, and that's something we don't want! I don't know if it's possible to create two schemes (one for developers/users, one for observers) linked to the same project, but I'm quite sure that I'm not the one who is able to figure it out.

In a nutshell, this is what we need:

• Our developers/users need to be able to view and work on all our projects, including Project ABC
• Customer XYZ should only be allowed to view/monitor Project ABC, and none of the other projects.

Is this possible? Thanks in advance!

Tristan

[Ignacio Pulgar]

I think you just have to follow these steps:

1. Go to Permission Schemes (press 'g' key twice in JIRA and type Permission Schemes)
   1. Copy the 'Default Permission Scheme' by clicking on the 'Copy' link, and name the copy 'ABC Permission Scheme'. (Assuming you were using the Default Permission Scheme)
   2. Click on 'Permissions'.
      1. Add the observer role to the 'Browse' permission.
      2. Check developers are included in the permissions they need to have.
2. Link 'ABC Permission Scheme' to your project.

[Tristan Latour]

Hi Ignacio and Sateesh,

Thanks again for the help, unfortunately something still goes wrong, I'll try to explain what exactly.

As both of you told me, I added the observer group (which at the moment only contains my observer test account) to the "Browse Projects" in the Permission Scheme which is linked to Project ABC only.

JIRA issue 01.JPG

When I then go to User Management, I see that the 'tristan-observer' account (my test account) is indeed only added to the observer group.

JIRA issue 1.JPG

However, the JIRA checkbox is unchecked. If I then try to log in as 'tristan-observer', nothing really happens. I only see "System Dashboard", nothing else.

JIRA bugreport.JPG

When I switch back to my admin account, and check the JIRA checkbox, the 'tristan-observer' account is not only added to the observer group, but also to the 'jira-users (default)' group.

JIRA issue 2.JPG

When I then again try to log in as 'tristan-observer', this is now possible, but the problem is that the account now has full access rights to all projects, instead of only being able to observer Project ABC. Unchecking the JIRA checkbox again brings me straight back to scenario one. 

Any idea how I can work around this? 

[Sateesh Chandra]

Edit your existing project permission scheme (where everything was working fine) , In the browse issue permission, add the user name of the observer directory (single user). Also make sure that the permission scheme is not assigned to any other project.

Let me know if it helps

[Tristan Latour]

Thank you both! I'll go ahead and try it right away, I'll let you know if it solved the issue.

[William Rojas (Black Diamond)]

did you grant JIRA user global permision to the observer group?  

by default this permission is granted via jira-users, but since this group will likely be used in all other permission schemes, then you can't grant jiraa access to observers using the default..

[Tristan Latour]

Hi William, Thanks for your feedback, indeed we simply used the 'Default' settings, so permission is granted via jira-users. I guess we have to change the permission scheme a bit then, making the observer group the global permission scheme whilst adding other roles (with more permissions) later?

[William Rojas (Black Diamond)]

actually all you should need to do is add your observer group to the global jira user permission, that will grant access to those user to jira, but since your project permission does not grants only browse to observers on that one project then you end up restrictions that group to just access jira and browse that project. this will impact anything else , like dashboards, filters, agile boards for observer role, mainly it will be empty or missing so you'll need to adjust all of that as well. I would jeep jira users as the default way to grant jira permission. the change is that you end up with users in observer group. note when you add new users to system they get added to jira-users by default, so youll need to ensure observers get added to right group when registered