Mmm, Jira security is powerful, and hence complex, and I think you've gone in the wrong direction!
First, security schemes are there to protect individual issues within a more widely published project (example - a project for logging incidents is available to all users, but in cases where the fault was human and the incident managers need to tell off the human, they set the security level to "private" to hide just that case). So forget them, they're not relevant to what you're trying to do. They don't override any security at a project level, all they do is block people from specific issues.
Secondly, I think you've got the basic idea right - if Jira knows who the current user is, it will show them issues that they can see. This is determined by the project permission scheme in the first instance, so you need to check that for each project you want to display issues from. Look specifically at the "browse" permission - that will tell you who can see the issues, but it always depends on Jira knowing who is asking. You were on the right track with the "anyone" group, but you need to do that in "browse" for the project permissions, and then you'll have allowed anonymous access to the entire project. (Recommendation - never use "anyone" for anything else, otherwise you'll find changes being made without any tracking of the user who did it. Also, check your workflows for the project - make sure every transition has at least one "condition" as transitions without any will let "anonymous" move things through the flow)
Finally, there's the "who are you" stuff, which prompts me to ask questions:
- You don't mention what authentication you're using (Crowd? Plain login? AD?), or how you're trying to do the "list of bugs", so Ican't ramble at length on this.
- Have you looked at "trusted applications"?
- Also, your list, is it using one of the Jira macros? If so, try appending |anonymous=true to the end - that will tell confluence to tell Jira it wants anonymous access (so your authentication won't actually matter any more), but is dependent on you using "anyone" in your permission schemes.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.