User access settings - How do roles and groups work here?

[Steven Zeck]

Hi all!

I see on the User access settings page under Approved domains, you can configure which Product role each user gets for each product. The options here are User and No role. If User is selected, does it automatically add each account to the <product>-users-<sitename> group (like jira-users-myorg) when users sign up?

For something like Jira Product Discovery, is it possible to configure via User access settings so that users are added to the jira-product-discovery-contributors-myorg group, and not jira-product-discovery-users-myorg?

I've been trying to figure out if default groups are the answer, but I don't quite understand how those work. It seems that not only does each product require a default group, each product role for each product requires a default group. In the case of Jira Product Discovery, those are Contributor, User access admin, and User (creator). What purpose do these serve exactly?

Thanks in advance.

[Kieren · Accepted solution]

Hi @Steven Zeck 

Q1: If User is selected, does it automatically add each account to the <product>-users-<sitename> group (like jira-users-myorg) when users sign up?
A1: Yes, that's correct.

Q2: is it possible to configure via User access settings so that users are added to the jira-product-discovery-contributors-myorg group
A2: Unfortunately no, it's not possible today without using an API/Script or a 3rd party app.

Q3: It seems that not only does each product require a default group, each product role for each product requires a default group. In the case of Jira Product Discovery, those are Contributor, User access admin, and User (creator). What purpose do these serve exactly?
A3: The second part of this is correct. Every Product Role (e.g. Jira User, Confluence User, Confluence Admin, etc...) needs a default group assigned to that role. All Atlassian products assign users access via groups. From the User Details or Invite screen, when you select "Give User ABC access to Jira as a User", in the backend the system is just looking up the default group for Jira Users and adding the user into that group. It's just how it works...

As @Yousif Hassan mentioned, Scriptrunner is one app that could be used to help add users to the JPD Contributor group. Another is Admin Automations (that we build), where you can automatically add or remove users from different groups.

Hope that's useful.

-Kieren

[Steven Zeck]

Hi @Kieren. Thanks for the reply. All of that makes complete sense now. I guess my lingering question is, how are the default groups of jira-product-discovery-contributors-myorg and jira-product-discovery-user-access-admins-myorg used right now? If there isn't an option to give users access as Contributor or User access admin via the invite screens, I don't see where Atlassian Admin would use these other default groups.

[Kieren]

The Contributor and User Access Admin roles are only unavailable via the User Access Settings screen. They can still be granted to users via the User Invite and User Detail screens (see images below). But, they have to be granted by an Admin.

It's certainly less useful that these two roles are only able to be manually granted by Admins. This is why we built the Admin Automations app, to fill in these sort of gaps that Atlassian Admin has. Gaps like this will always exist unfortunately...

-Kieren 

[Yousif Hassan]

I've used Scriptrunner to create a solution for something similar to this in the past - happy to share my approach or do it for you. My best email is: yousif@usenexus.com.au