Issues viewable by Reporter only but commentable by everyone?

[Julian Emmerling]

Hi everyone,

I am currently struggling with a permission/issue security issue I can't wrap my head around.

We want to restrict the issues in our project to only be viewed by the reporter. I was able to easily configure that with a new issue securty scheme which only grants permissions to our service desk team and the reporter.

However what happens with that configuration is that another customer (same Organization) is not able to comment on an issue when he is not the reporter (comments via email). The following message is found in the processing log:

Additionally when I use the permission helper in the issue it complains that the user that can't comment is not member of my security scheme.

I know I can edit the issue security scheme to add another role or group to it and grant the customer the permission this way. However if I do that the customer can see all issues of his organization, which we want to prevent.

[Vasiliy Zverev]

Issue sequrity scheme allows to set visibility on each issue into a project/

If you want to grant permission for all project it is better to use permission scheme and permission for browse project.

[Julian Emmerling]

I see.

How would I set up the permissions so only the reporter can view his issues and everyone can comment?

Also how would I go about further granting/restriction permissions for single organizations? I need the possibility to grant managers of the customer also permission to view the issue. Would I do that with the issue security schemes or the permission scheme?

[Vasiliy Zverev]

Is it good idea to allow comment issues, but not view it?

Set view permission for organisations could be implemented with sequrity schema. Create a group for each organisation and sequrity level. Add each group to each sequrity level. Then for each issue you should set respective sequrit level.

[Julian Emmerling]

Well, ideally the reporter and the request participants can view the issue. Using securtiy schemes it was not possible to add request participants so we decided to do only the reporter. Maybe thats possible with permissions?

We need everyone to comment via mail (for obvious reasons) but not be able to browse the issue for compliance reasons - that should be reserved for managers in the future.

[Danyal Iqbal]

Use permission scheme . Security levels should be used to manage partner accounts or customer accounts with multiple users.

[Georg Karner]

I tried to do that, but I ran into issues.

For my case I would need to remove "Service Desk customer - portal access" from the Browse Projects permission. However, as soon as I do that JIRA complains about permission errors that need to be fixed (cannot dismiss) and functionality gets impacted.

I tried again with the issue security scheme in a dummy project and it works as expected there. This leads me to believe the error im getting in the processing log is solveable somehow.

What I also noticed in our productive project with the problematic security scheme enabled:

Comments via email from non-reporters on an issue get declined with the error in my screenshot (no permission to view attachement), but attachements sent with the email still get attached to the issue.

Meanwhile Atlassian advised me to disable the "cr-share-request" module - I will try that but I'm not sure what functionality this will impact.

[Julian Emmerling]

whoops, logged in with the wrong account - thats my reply ;)