ldap vs external user

[Darius Tanz]

hello,

We use Jira in our corporate company and logins are only through LDAP. 

The permissions of our projects are assigned to the “jira-software-user” group by default. However, we created a new schema for our two new projects, called “externaluserank” and access to this schema is set to “externalusergroup” only.

We added two people as external users and assigned them to the “externalusergroup” group. However, these users cannot log in. When we add these users to the “jira-software-user” group they can log in, but when they are removed from this group they cannot log in again.

We need your help on how to solve this important issue.

Thank you.

[John Funk · Accepted solution]

Hi Darius,

You need to grant access to the Jira Software product to the externalusergroup group. 

Also, it's a better idea to grant permissions based on Project Roles rather than groups. You can then give the group the a project role that gives them access to the project if you like. It helps to avoid things like this. 

[Darius Tanz]

Hello. Thanks for your answer. There is a problem like this;

In all other projects it is set as "any logged in user". When I add an external user, he can see other projects.

Therefore, it was necessary to edit from shaman. However, if I do not assign it to the group as jira-software, he cannot log in.

How can I solve this?

[Dick]

Just like @John Funk said. 

Please realize that up to now, you've actually been cutting corners on the security front by using the 'any logged in user' group. 

So it's time to man-up, bite the bullet and provide proper roles to the projects.

There is no other way.

[Darius Tanz]

You are right, thank you very much. I wish you good work.

[John Funk]

You are very welcome!

[Anandhi Arumugam _Cprime_ · Accepted solution]

Hi @Darius Tanz 

If you want the External user to view a Software project, the only way is for the user to added to the Jira Software application access (jira-software-users group). This means the user will be able to view anything accessible to logged in users. If you wish to change the permissions, the way forward will be to alter existing permission schemes to provide access only based on Project Roles as @John Funk mentioned.

This means, assign permissions in permission schemes to Administrator or Developer or Users project role and change the Project People assignment to these respective Roles. I know it is a tedious task, but consider it as a chance to establish Governance.

Hope this helps.