Create Read Only Users

[Shawn Olson]

I am trying to figure out how to make a subset of our internal users read-only.  I have read through only documentation and there are references to Permission Schemes and such, but they make no sense to me when I go and try to apply.  Does anybody have a simple step by step method to make a user read-only?

I want them to see the individual issues within a project, but not have access to edit or modify anything.  Thought it would be simple enough like creating a group or applying a permission to a user/group, but no such luck.  Thanks.

[John Funk · Accepted solution]

Hi Shawn,

There is really no such thing as creating a read only user. You just create users and either grant them permissions to see things or not. 

So whether you can see a project (and all issues created against that project) is controlled by the Browse Project permission within the Permission Scheme attached to the project. 

1. Navigate to the Project Settings for the project in question. 

2. Click on Permissions.

3. Click on Actions -> Edit permissions. Now, before you edit this permission scheme, make sure it is not the Default Permission Scheme for the system. Or if it is and you are sure that's what you want for all projects that use it, then go ahead.

4. Modify the Browse Project permission to only include the people you want to see the project. 

5. If you want people to be able to see it but not edit or create (read only more or less), then modify the Create Issues and Edit Issues permissions to not include those people. 

[Shawn Olson]

This is great.  Thank you so much John!

[davesoft11]

Just fleshing out the details that read-only support requires more steps because it's effectively removing a permission rather than adding one.

So, it's possible that your various functions may currently be set to be allowed for "all logged in users" or everyone with access to a project or in a project role, etc. Going "read-only" means you lose that broad stroke because I don't think there's any way to say "everyone except...".

So in my case, most of my users fall into group X or Y, but since I didn't have any that needed to be "read only", those groups were not used anywhere in the Permission Scheme. So I put my new read only user into a new group Z, and then had to redo virtually every line item in the permission scheme to 1) remove the existing permissions, usually based on Project; 2) add groups X and Y; and 3) in the Browse Project permission, also add group Z. 

(In fact, mine is slightly more complex; Administrators have unique access in places, etc)

I should be using Project Roles more, rather than Groups, but for legacy reasons involving many projects, that was too complex to do at this time. 

Hope this helps.