How do permissions and workflow conditions interact?

Mary Peek Atlassian Team Jul 19, 2017

I have a user who does not have the Close Issues permission in the permission scheme. She's using a workflow that has no conditions on the Close Issue transition (i.e. no checking for the Close Issues permission). As expected, she can see the transition button to close an issue. And she can close the issue. But I would have expected her not to be able to close the issue since she doesn't have the Close Issues permission from the permission scheme. Even though the workflow gives her the ability to execute the transition I thought JIRA permissions from the permission scheme would stop her. Do you have to have both set? How do permissions and workflow conditions interact?

I'm using JIRA Software v7.4 server.

1 answer

1 accepted

0 votes
Steven Behnke Community Champion Jul 19, 2017

Things have changed over time. 

In JIRA 6.3 or6.2, Atlassian added a new permission called 'Transition Issues' permission. This is what is being checked now.

You can use the Close permission just like you could in Classic Jira. Add a condition to the Close transition, choose Permission Condition, then select Close Issues permission. 

This will get you the desired output in older and newer versions of JIRA. Effectively you need to apply the conditions to the workflow yourself, JIRA has no concept of a 'close' transition. 

Mary Peek Atlassian Team Jul 19, 2017

So being able to execute the transition (with the Transition Issues permission) which contains an Issue Closed event in the post function, actually closes the issue. Even though she doesn't have the Close Issues permission in the permission scheme. So the combination of all this trumps the Close Issues permission? I always thought that if you did not have the Close Issues permission then you couldn't close issues. I guess, as is often the case, it depends!

Steven Behnke Community Champion Jul 19, 2017

The Issue Closed event really only ties a specific notification template to that event. It doesn't indicate to JIRA that the conditon needs to be permission protected. Permissions and Events are not related to each other.

It has always been the case in JIRA that you needed to apply the Permission Condition: Close Issues Permission to the appropriate Transitions.

If you had to have Close Issues permission close issues in the past, that means you were either using the Default JIRA Workflow (which uses these conditions by default) or you had an Admin that used the Permission Conditions on custom workflows.

JIRA does NOT do the work for you. Again, you can name a transition ANYTHING you want. JIRA can't possibly know that a transition named "ajsdkfdsafk" leading to a status named "asfdsijvsaf" needs to be protected by a Close Permission. You must provide this framework by using the existing conditions/permissions on your custom workflow.

Steven Behnke Community Champion Jul 19, 2017

Before the "Transition Issues" permission, if you didn't use the permission conditions, even logged out users could execute transitions. This was more fragile before the "Transition Issues" permission was released.

Mary Peek Atlassian Team Jul 19, 2017

Thanks!

Steven Behnke Community Champion Jul 19, 2017

No problem at all! I love talking JIRA.

Suggest an answer

Log in or Join to answer
Community showcase
Sarah Schuster
Posted Jan 29, 2018 in Jira

What are common themes you've seen across successful & failed Jira Software implementations?

Hey everyone! My name is Sarah Schuster, and I'm a Customer Success Manager in Atlassian specializing in Jira Software Cloud. Over the next few weeks I will be posting discussion topics (8 total) to ...

2,777 views 11 18
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you
Atlassian Team Tour

Join us on the Team Tour

We're bringing product updates and pro tips on teamwork to ten cities around the world.

Save your spot