JIRA Security - Hiding Custom Fields and Workflow

[Eva]

I know there is a ticket (JRA-1330) for this and there is one plugin exist that hide certain fields from user/groups. But is there one to hide the workflow as well?

The current situation I have is that we have an internal group (for developer, testers) and external clients, and we want to hide the workflow and most of the fields from our clients. Currently our design is to duplicate the production ticket to internal, but updating back and forth can be a pain (even though we can always create plugin that can update most of the time). I just want to see if anyone has found a solution that can hide both fields and workflows.

Thanks!

[Penny Wyatt (On Leave to July 2021)]

The solution is to place a condition on the workflow transition (e.g. "Resolve Issue") that restricts it to only certain groups. This will hide the transition buttons from anyone who doesn't have this permission.

Full instructions are here: http://confluence.atlassian.com/display/JIRA043/Configuring+Workflow#ConfiguringWorkflow-Addingacondition

For example, to allow only members of the "internal-devs" group to resolve an issue, go to the "Resolve Issue" transition (instructions in the page linked above) and click "Add a new condition".

Pick the "User is in group" condition and pick the group that should be allowed to perform the transition:

Alternatively, if you are using project roles, you can restrict it based on a role instead of a group.

[Eva]

can you explainn more on project roles? the method you suggest work but for my project, that would require us to add that condition for every transition just to hide the workflow from external users, which would be a pain. If there is some other way to limit the user ability to change status, that'd be great.

Also, i assume that still cant hide subtask?

[Eva]

hiding the ability to change the status of the issue.

Also to add a note, I suppose, JIRA cant hide subtask?

[Penny Wyatt (On Leave to July 2021)]

By "hiding the workflow", do you mean hiding the ability to change the status of the issue, or hiding the status itself?