Prevent administrators from seeing selected issues

[Mark Hetherington]

We need to have several administrators bcause people are maintaining their own projects and need to add custom fields etc.

We have a requirement that some issues inone or two projects are only viewable by a few people.

Issue Security would seem to be the solution but anyone in the adminisstrators group can go and change the Issue Security even if they are not even mentioned in the different security levels.

Is there any way of configuring Jira to achieve our requirement?

[Mark Hetherington · Accepted solution]

The plugin doesn't work OnDemand.

Separate Jita instance not viable OnDemand and also links are required between Confidential and non-Confidential tickets.

It is accepted that Jira Admins should be trusted; we just have quite a few of them as we allow them to create Custom Fields etc. for individual projetcs.

It is also accepted that if people stumble accross something Coonfidential they might read it but are far less likely to take action to be able to see somethig e.g. change a Permission Scheme change Issue Security.

As Issue Security is more granular, less known and less easy to change unintentially, this method has been selected. At admin would actively have to go into a project's config and change the security levels which is quite n active thing. Chaniging a permission scheme is easier and, because they are often shared between projects, are more likely to be changed and inadvertantly expose material.

So choice is Issue Security and trust your admins.

[RambanamP]

i am sure that following plugin will help you

https://marketplace.atlassian.com/plugins/com.jtricks.j-protect

[Nic Brough -Adaptavist-]

Administrators could still disable/remove the plugin.

I don't think there's any answer other than "You have to trust your administrators". I suspect that applies to all software, there's always a way for "root" to do something.

[Jobin Kuruvilla [Adaptavist]]

Agree with Nic here. They can still uninstall the plugin. But most people do things accidently and won't try it if they are blocked from doing it ;)

For example, if a page is protected, most people won't get around it by uninstalling the plugin that protects it.

[Peter Van de Voorde]

I have to agree with both Jobin and Nic.

Seperate Jira instances might be an answer, but that's costly to maintain.

Best regards,

Peter

[Mark Hetherington]

It would seem that jprotect only works for webwork actions for now and is also not available on Atlassian OnDemand or have I got something wrong?

[Nic Brough -Adaptavist-]

Yes, it's only for webwork actions, although a lot of Jira is controlled that way.

It is definitely *not* available in OnDemand.

[V]

We can use permission schemes

1) create a group for the project and add menmbers who should see this project

2) Restrict the "Browse Permission" under Permission Scheme for the project to the above created group.

Hope this helps.

[Alex Perez]

Setup a separate JIRA instance in a separate database and establish one of the "legit" users as admin.

IMO you have a big problem if you don't trust your sysadmin/dbas ... they always can find paths to access that info if they want (i.e export jira database and import into a stagging env, access directly to the db, ...)