Whats the difference between the ADMINISTER and SYSTEM_ADMIN permission in JIRAs API?

[James Dumay]

Whats the difference between the ADMINISTER and SYSTEM_ADMIN permission in JIRAs API?

[mlassau_atlassian]

An "Admin" can do most anything except operations that could potentially compromise the security of the underlying operating system.
As a corollary, an Admin may not do any action that could elevate their own or someone else's privileges to that of "SysAdmin".

Historically the distinction was created for the "JIRA Studio" hosted suite.
(See JRA-13282)
Hosted customers are able to create "admin" accounts, but "sysadmin" privilges are reserved for Atlassian and hosting partners.

[spuddy ಠ_ಠ]

The differences between these two permissions are covered in the Global Permissions documentation.

Users with the SYSTEM_ADMIN permission can do any administrative action.

Users with the ADMINISTER permission can perform most administrative actions. Some exclusions include configuring SMTP, importing/exporting etc.

The intent of the separate ADMINISTER permission is that organisations may want to delegate tasks like user management to a group of people, without allowing them to do "system" administration actions (actions that might compromise the security of functioning of the host).

[James Dumay]

So if I were checking to see if someone had PROJECT_ADMIN should I check for ADMINISTER and SYSTEM_ADMIN too?

[spuddy ಠ_ಠ]

Yes you have to check for both, permissions don't inherit/piggyback off other permissions.