How can we restrict a Jira admin to just create\Delete user and not modify user details

[Sijo Kurien]

Hi,

I have a JIRA System Admin, who should be able to create JIRA Admins. 

Due to our specific project need, which is beyond my control, the JIRA Admins must  be able to just create\delete user details but not modify them. Specifically we do not want the admins to change the username of the users.

Please let us know if there are any solutions\workarounds or any plugins which can achieve this functionality.

[Nic Brough -Adaptavist- · Accepted solution]

Nope, there is no way to do this without hacking the core code to block the modify functions.  The usual approach here is to simply "trust your admins".

[Sijo Kurien]

Any plugins available? Or is there any way to remove modify role while creation itself?

[Nic Brough -Adaptavist-]

If there were plugins that could do it, I wouldn't have said "no". Admins have admin rights, and that includes updating user profiles. Atlassian are looking at making it more configurable, which will lead to many different types of admin, but I suspect the right to edit users will still be bundled with the right to add and delete them (it's a very odd thing to want to add users but not update them. What happens when your admins mis-spell something?) There is an option other than code - hook JIRA up to a user directory system that can handle your requirements. I'm not sure if you could hack an LDAP service to allow "add but not edit", but it probably would be easier than trying to wedge this into JIRA

[Sijo Kurien]

Ok. Understood. I mean atleast making the username field uneditable is possible? Just asking again. Even from backend, if there is any option is possible.

[Nic Brough -Adaptavist-]

Oops - another option would be to downgrade your admins to ordinary users and set up a system that can automatically create users without allowing edit. I've done that as a JIRA project before. Needs, a bit of code to handle user-create as a post-function and we did it with an email handler too, but it works well.

[Nic Brough -Adaptavist-]

No. As I said, you'd need to hack the code.