Scriptrunner Behaviours - field is not hideable message

Question

I would like to make a customfield hidden if a user is not in a certain group. For this I added a mapping to a project and issuetype in scriptrunner -> behaviours.

Now when selecting the behaviour for the field (I picked "Hidden") I get the message:

The field Testing is not hideable, so it will only be hidden when the issue is editable.More info.

The condition I am using is "Except" and I am testing for "Current user in group: XYZ"

The field itself is a multiline textfield (enabling or disabling the search index has no effect).

How can I find out why the field is not hideable? It is not marked as required or such.

JIRA-Version: v7.12.3

Jan Mueller · Answer

Hi Johannes,

I've abandoned it using the tools / plugins available back then. There should be plugins which allow it though.

Your "workaround" would probably work really well. You have to consider that jira does send the information in mail (depending on what rules are set up) and there it does not obey security schemes. This could be a potential leak.

best,

Jan

Johannes Rudolf_ep01hv · Answer

I had the same issue today and I have learned the following.

tl;dr

The error message is misleading in a way. Also the manual does not reflect this limitation even though it is such one. However, behaviours do only work for edit and create screens, NOT for VIEW screens. See here.

Depending on your use case, which is not precise enough to say wether it helps you or not, you may still hide a field with the help of behaviours but only for the purpose of creating/editing an issue. You only have to consider that a field can be viewed though - it cannot be viewable for a particular group of users exclusively.

----

Alternatively you can work with an issue security schema which I am considering for my case. For example there's a personal information required in order to fulfil a certain service request via Service Desk (let's say reset password, an issue will be triggered by mail). Only a very limited number of people apart of the requester should be able to view it.

* Create an Issue Security Schema
* Add at least one level
* Add at least one person, project role, group etc. to that level
* Associate the schema with your Jira project(s)
* Add the field "Security Level" to the associated screens (at least create screen)
* Make sure that the Security Level can be set (grant/limit permission within permission schema if necessary)
* For Service Desk: add the field to the dedicated request type form as a hidden field, set one security level as a default
* For Jira Software: add a post function to the associated workflow (Script Post-Function [ScriptRunner] --> Set issue security level depending on provided condition) - a condition is not mandatory as far as I know.

Hope this helps.

Cheers,

Johannes