How can you make a Client Role that only can comment on their project but not see all the other user projects

[Jordan Ehrhardt]

How can you make a Client Role that only can comment on their project but not see all the other user projects?

So far a created a "client role" that has comment only permission, but when I log in as them they still have access to all other user projects.  What i'm I doing wrong?

[Nicolas Bourdages]

The problem could be in the permission schemes of these other projects. Your client user might be present in a Project Role through membership in the jira-users group for instance, and gain Browse permissions from that. Since any user who wants to log in must be present of that group, your client user is bound to be a member of at least one group.

If that's the case, here's what you should do to fix this with minimal effort:

1. Create a new user group for clients (call it client or external or something)
2. Give that group permission to login in the Global Permissions
3. Make sure your client users are in that client group only, not in jira-users.
4. Add the user in a Project Role of your specific project

[Nic Brough -Adaptavist-]

>Give that group permission to login in the Global Permissions

Remember that this means all new users will be added to the client group.

[Nicolas Bourdages]

True. The truly best (longer to implement) solution would be to go and change the permission schemes to use project roles, and project roles so they use a custom group of in-house users, and leave jira-users strictly for login and nothing else. That's how it should have been anyway, external users or not.

And give a crack of the whip to users who share filters and dashboards to jira-users while you're at it. They probably deserve it for something else too, pesky users!

[Nic Brough -Adaptavist-]

Divorcing "can log in" from "has access to almost everything" default usage of jira-users is the first thing I do to JIRA systems.  For the last 12 years!