Groups affecting discrete Confluence or Jira permissions

[Jim Weaver]

The Crowd documentation seems to be unclear on this point.  It states that groups can be created and managed in Crowd, and these groups can be used to allow access to individual applications such as Jira and Confluence.

What about cases where you have fine-grained permissions to deal with by group rather than just "access"?  If I want a team, let's say "team1," to have access to certain spaces in Confluence, or ability to act as a developer on a particular set of projects in Jira, is it possible to manage this in a Crowd-driven way?

If I create a group entirely in Crowd, assign users to it, and they login to Confluence or Jira, are those groups visible to Confluence and JIra to use for permissions / authorization rather than just authentication?

If a group exists in Crowd, when on the SPace permissions page in Confluence, is that group visible to grant permissions to in a non-user-specific way?  In other words, would I be able to add "team1" as a permissions row for a space and tick permission check-boxes for that group?

My guess is - not possible - otherwise it seems like this capability would be very much featured in the Crowd docs.

[Bruno Vincent]

Hi @Jim Weaver 

Crowd currently provides centralized user and group management, not centralized permissions management.

That means that any user or group you see and manage in Crowd will be synchronized to the corresponding connected applications (e.g Jira, Confluence) but apart from the right to login you still have to manage what you call 'fine-grained permissions' in the applications themselves.

That being said, Atlassian announced that "surfacing cross-product information such as license usage or permissions directly in Crowd" is on their radar.

[Jim Weaver]

Heya Bruno - thanks!

From your description - I think that's what I'm looking for.

If a group created in Crowd is visible as a group on permissions screens in Confluence and Jira, then you can use Crowd groups rather than Jira-visible-only or Confluence-visible-only groups to assign permissions in those respective applications - removing the need to repeatedly create and define membership of the "team1" group, for example, in Jira, Confluence, Bamboo, etc.

If you use a lot of Atlassian apps, having to maintain groups and group membership in and of itself becomes a chore - so a key benefit of Crowd may  just be reducing that overhead.

j