How do permissions and workflow conditions interact?

Mary Peek Atlassian Team Jul 19, 2017

I have a user who does not have the Close Issues permission in the permission scheme. She's using a workflow that has no conditions on the Close Issue transition (i.e. no checking for the Close Issues permission). As expected, she can see the transition button to close an issue. And she can close the issue. But I would have expected her not to be able to close the issue since she doesn't have the Close Issues permission from the permission scheme. Even though the workflow gives her the ability to execute the transition I thought JIRA permissions from the permission scheme would stop her. Do you have to have both set? How do permissions and workflow conditions interact?

I'm using JIRA Software v7.4 server.

1 answer

1 accepted

0 votes
Accepted answer
Steven Behnke Community Champion Jul 19, 2017

Things have changed over time. 

In JIRA 6.3 or6.2, Atlassian added a new permission called 'Transition Issues' permission. This is what is being checked now.

You can use the Close permission just like you could in Classic Jira. Add a condition to the Close transition, choose Permission Condition, then select Close Issues permission. 

This will get you the desired output in older and newer versions of JIRA. Effectively you need to apply the conditions to the workflow yourself, JIRA has no concept of a 'close' transition. 

Mary Peek Atlassian Team Jul 19, 2017

So being able to execute the transition (with the Transition Issues permission) which contains an Issue Closed event in the post function, actually closes the issue. Even though she doesn't have the Close Issues permission in the permission scheme. So the combination of all this trumps the Close Issues permission? I always thought that if you did not have the Close Issues permission then you couldn't close issues. I guess, as is often the case, it depends!

Steven Behnke Community Champion Jul 19, 2017

The Issue Closed event really only ties a specific notification template to that event. It doesn't indicate to JIRA that the conditon needs to be permission protected. Permissions and Events are not related to each other.

It has always been the case in JIRA that you needed to apply the Permission Condition: Close Issues Permission to the appropriate Transitions.

If you had to have Close Issues permission close issues in the past, that means you were either using the Default JIRA Workflow (which uses these conditions by default) or you had an Admin that used the Permission Conditions on custom workflows.

JIRA does NOT do the work for you. Again, you can name a transition ANYTHING you want. JIRA can't possibly know that a transition named "ajsdkfdsafk" leading to a status named "asfdsijvsaf" needs to be protected by a Close Permission. You must provide this framework by using the existing conditions/permissions on your custom workflow.

Steven Behnke Community Champion Jul 19, 2017

Before the "Transition Issues" permission, if you didn't use the permission conditions, even logged out users could execute transitions. This was more fragile before the "Transition Issues" permission was released.

Mary Peek Atlassian Team Jul 19, 2017

Thanks!

Steven Behnke Community Champion Jul 19, 2017

No problem at all! I love talking JIRA.

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Nov 27, 2018 in Portfolio for Jira

Introducing a new planning experience in Portfolio for Jira (Server/DC)

In the past, Portfolio for Jira required a high degree of detail–foresight that was unrealistic for many businesses to   have–in   order to produce a reliable long-term roadmap. We're tur...

2,693 views 18 21
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you