I've ensured that a particular user does not have the "Browse users and groups" global permission, but when I login as this user and go to the People tab from the top navigation bar (/jira/people/search), I am still able to browse all users.
Is this the expected behavior?
How can I prevent a user from browsing users and groups? And then how do I properly verify that this is working?
This seems to be an issue with the "Log in as user" functionality.
If I create a new account and log in conventionally (with username & password) as that user without the global permission, I am not able to browse other users in the People tab.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.