Issue Security allows for user to view search results for all issues?

[Sarah Kladstrup]

I am attempting to implement a set of permissions and issue security schemes to only allow "External Users" to see tickets. When I log in as an external user, I can only open the ticket with the "external user" security level. However, I am able to search and add any column I want and that information is displayed to this user. I am certain these other issues have a different security level of "employees only". What's the point of the issue security scheme if it shows everything anyways, or am I missing a permission I should restrict?

[Petter Gonçalves · Accepted solution]

Hello Sarah,

Could you please elaborate a little bit more about what you meant with the sentence below:

However, I am able to search and add any column I want and that information is displayed to this user. I am certain these other issues have a different security level of "employees only".

It is not clear on how you are displaying issues to other users out of the security level. Could you give us an example with screenshots so we can better understand it?

That been said, I can clearly confirm there is some misconfiguration in your security level if you are able to see any information of issues that are added to a Security level which you do not belong.

Even searching for issues, it will not display issues if you are not added to its security level as you can see below.

1 - When I am added to the security level test:

2 - When I removed myself from the security level:

We will be waiting for your answer.

[Sarah Kladstrup]

Petterson,

Thank you for your quick reply and all your help! I realized that while in the detailed issue view, there was a security level displayed, that was not reflected in a search of the project's issues (so all tickets were effectively "none"). I had set most of these with the bulk issue tools. This is a different issue altogether, but still confusing. Even re-bulk editing left some issues without a security level.

I ensured all tickets had a security level via the search results, and now I'm getting the permissions/visibility I would expect for our "external users" group.

Thanks,
Sarah

[Petter Gonçalves]

Hello Sarah,

Thanks a lot for your feedback. I'm glad to know you were able to find the root cause of the lack on your security level.

Have a nice weekend!