How Can I enable Reporters to add individual watchers to an Issue that only Reporters and an Enterprise Support Group have access to view without opening the issue to everyone in the enterprise?

[Beth Schaefermann]

I have a support project available to the enterprise where the only two groups who can view issues are the Support Admin Group and Reporters. The reason that this security is required is that reporters come from a variety of clients who should not see each other's issues due to client-confidentiality agreements.

The problem is that reporters would like to assign individual users as watchers to a ticket. The only way that I can see to do this is to create unique groups for each project and allow the reporters to change the security level on the ticket. This solution comes with unacceptable side effects: (1) it would be time-consuming and would become quickly inaccurate to maintain separate Sys Admin defined groups from Project Admin defined project membership (challenging), (2) Reporters would be able to view project-related groups across the enterprise (unacceptable).

Is there any other way to satisfy this request that I might be missing? A plug-in? Upgrade to JIRA 4.4 (we are currently running 4.3.4 and are in the process of an upgrade)?

This question is tangentially related to:

https://answers.atlassian.com/questions/13718/reporter-to-see-own-issues-only

[mlassau_atlassian · Accepted solution]

So actually the first thing you want to be able to do is let the reporter choose other people who have permission to view the issue.

• Firstly create a multi-value User custom field and call it "Other Viewers" or whatever.
• Add this custom field to the "Default Screen"
• Next add one more permission to "Browse Project" - users in the "Other Viewers" Custom Field

Now reporters can add users to this field on create and edit, opening the issue to those extra users.
(This is actually what Atlassian does on support.atlassian.com with field called "CC")

Next you want to be able to add these users as watchers as well.

• You could ask the reporter to then also add those people to the watchers field as a separate operation.
  The downside is it takes two actions to achieve, the upside is it give more fine-grained control - the user may not want notifications, but they want to be able to view the issue.
• Alternatively, you could go edit your notification scheme to always send to users in the Custom Field.
  No double-shuffling, but users may not like the extra "spam".

[Ulrika Eriksson]

I followed the steps, now I have this new field "Other Viewers". But the users in this field on a specific issue cannot se the issue they are suppose to view?

-field

-added to screens

-browse project permission

Something is missing?

[mlassau_atlassian]

Sorry, my instructions only cover setting the Browse Project Permission, when it is likely that you are using Issue Security Levels.

You need to make sure that the users in the "Other Viewers" custom field not only have Browse Project permission, but also have permission to see the given Security Level.

If you want to find out why someone can't see an issue, and you are an admin, you can use the "Permission Helper":
Go to the issue, and choose "More > Permission Helper".
I believe this is built-in to JIRA 6.0 and higher.
For older versions, you can install a free plugin: https://marketplace.atlassian.com/plugins/com.atlassian.jira.plugins.jira-admin-helper-plugin

[Dana Frost]

Sounds like you would need to create diffrent security groups per end customer group. That might help but that may be too much admin? But if you are talking about individuals that cannot be easily grouped, I don't see how you could grant them the ability to grant permission to another individual. Especialy if you don't want to allow users to see other users in the system.

[Beth Schaefermann]

That might work if your users were allowed to see all of the other users in the system. Ours can't, because our permissioning needs to happen at the project-scope level, meaning that users of one project do not need to know about users of another project, but both sets of users need to be able to log support requests in one uber-project, and, ideally, add specific watchers (likely from their own projects) to that ticket.

If a user could type in the username of the watcher in the Add watchers field and that user could be granted rights on that specific ticket, that would be great. Unfortunately, we haven't been able to provide that capability yet without, likely, eventual customization.

[Beth Schaefermann]

I've spent a lot of time playing with this issue, and at this time, I can't work out a simple solution. Either the watchers have to have permissions to "browse projects" which exposes everything, or they don't which locks down their ability to be added as watchers to an issue that they did not report. Creating a user's custom field that would then push to the watchers list, would require too much know-how on the part of our users.

[Reatha Ek]

I am also interested in this one.

If I add watchers to the issue security level, won't they see more than they should?

Kind regards

Bernd

[JamieA]

I'm possibly missing something here, but can you not just give the Reporter the "Manage Watchers" permission in the permission scheme?

[Beth Schaefermann]

Tried that. The only watchers the Reporter can add are the Reporter himself or anyone in the Support Group; all other reporters are exluded from Add, because (I'm assuming) they don't have permission to browse issues they did not create.

[JamieA]

Longshot, but did you try add Watchers to the issue security level?

Another option might be a user custom field, which is copied to the watchers in a listener/post-function.