Limit access for external Service Desk users to Service Desk projects

[Sebastian Wramba]

Hi everybody,

the JIRA Service Desk ("SD") manual said that SD users don't count to the regular license. However, when somebody raises a SD ticket and completes the registering process, he is added to the group "jira-users" by Crowd which actually counts towards the JIRA licenses.

Not only that, he also has access to all the other non-SD projects. As the installation guide suggested, the JIRA is set to "Internal", but that does not help.

How can I limit access for external SD users to the SD projects only?

[Jack Brickey]

@Sebastian Wramba, can you check what you have setup under Applications > Application Access for JSD?

[Sebastian Wramba]

JSD can be accessed by group jira-servicedesk-users

JIRA Software can be accessed by jira-users and jira-administrators

[Sebastian Wramba]

I think this whole thing might have to do something with this issue: https://confluence.atlassian.com/jirakb/cannot-login-to-service-desk-as-local-user-when-crowd-sso-is-enabled-777026935.html

I think to make this work I will have to disable Crowd SSO for JIRA or otherwise, newly registered users will inevitably be added to the Crowd which automatically adds them to the jira-users and confluence-users groups.

[Nic Brough -Adaptavist-]

Not quite.  The manual says SD customers don't count.

You are adding normal JIRA users.  You need to be adding these people as customers rather than users. 

[Sebastian Wramba]

Thank you! Actually, our setup is pretty much standard. How do I change the registration so that it adds them as customers? Is there something in the manual I haven't seen?

[Nic Brough -Adaptavist-]

Possibly, although I think it's not an easy read.

https://confluence.atlassian.com/adminjiraserver072/enabling-public-signup-and-captcha-828787685.html#EnablingpublicsignupandCAPTCHA-EnablingpublicsignupforJIRAServiceDesk

I think you may have enabled public signup for all users, which gets them into JIRA as users, and you only really want public signup for SD customers.

[Sebastian Wramba]

To enable JIRA Software sign-up, the manual says it should be set to be "Public" (which it's not in our case). Sign-up for Service Desk is enabled.

I see that there is a "Service Desk Customer" group in JIRA, but none in Crowd (only jira-users and jira-servicedesk-users).  New users are automatically added to the jira-users and confluence-users group in Crowd.