How could I manage user access, anonymous access and IP filtering?

[Emilie]

We have Jira Software (Server) 100 users (v8.7.1):
- the 100 users can access and use Jira normally
- the rest of our employees can access Jira with anonymous access

We open our projects/tickets to "anyone on the web" and protect the access via IP.

We have 1 user who needs to access and use Jira (so have a user licence), who is part of an another company. And he has a range of IP different from ours.

If we authorize his IP, all the people from his company will be able to access our Jira, which we don't want.

The upgrade to 250 users is not an option for us, so I wonder if there is a way we could have this configuration:
- 99 users can use Jira (with IP1)
- the external user can use Jira (with IP 2) (100th license)
- the anonymous people with IP2 can't access Jira
- the anonymous people with IP1 can access Jira

If we allow the creation of ticket by email, how would the anonymous people get the updates or be able to see the tickets?

Thank you.

[Kagithala Babu Anvesh · Accepted solution]

Hi @Emilie ,

How about browsing Jira through VPN. ?

i found the below old article. May be a bit helpful. Please check this

https://community.atlassian.com/t5/Jira-questions/How-to-allow-all-users-ips-to-access-jira-server/qaq-p/659493 

Thanks.

[Nic Brough _Adaptavist_ · Accepted solution]

IP whitelisting is not a system that can identify individual accounts.  All it does it allows traffic from a known place.  So you either need to open it up for everyone at the users site and work out a different access model (which won't use anonymous access) or bypass the whitelisting.

You'll need something that can identify that user before allowing them into your network.

Most simple off-the-shelf solution here is a VPN - set up a server inside your network, create a route from the outside to your VPN server and then set up a VPN account for that one remote user.

[Emilie]

@Kagithala Babu Anvesh, @Nic Brough _Adaptavist_ thanks for your answers!

I know we already use a VPN internally, we may have to adapt it for the external user then - I'm going to check this.

Thanks.