does setting security level from script runner fail without error?

Here is my groovy code - it works perfectly, except for it fails to set the security level and no error is generated.

I can manually (using the JIRA UI) set the security level, as an admin. I have enabled the test user I've been creating issues with ('vendor2') for set security level, and they can do it from the UI.  

import com.atlassian.crowd.embedded.api.User
import com.atlassian.jira.ComponentManager
import com.atlassian.jira.component.ComponentAccessor
import com.atlassian.jira.issue.IssueFactory
import com.atlassian.jira.issue.IssueManager
import com.atlassian.jira.issue.fields.config.manager.IssueTypeSchemeManager
import com.atlassian.jira.issue.Issue
import com.atlassian.jira.project.ProjectManager
import com.atlassian.jira.user.UserUtils
import com.atlassian.jira.util.ImportUtils
import com.opensymphony.workflow.WorkflowContext
import com.atlassian.jira.project.Project
import org.ofbiz.core.entity.GenericValue
import org.apache.log4j.Category
def Category log = Category.getInstance("com.onresolve.jira.groovy.PostFunction")

Issue issue = issue
issueKey = issue.getKey()
log.debug "DBG: " + issueKey
issueMgr = ComponentAccessor.getComponent(IssueManager.class)
projectMgr = ComponentAccessor.getComponent(ProjectManager.class)
linkManager = ComponentAccessor.getComponent(IssueLinkManager.class)
linkTypeManager = ComponentAccessor.getComponent(IssueLinkTypeManager.class)
issueSecuritySchemeManager = ComponentAccessor.getComponent(IssueSecuritySchemeManager.class)
issueSecurityLevelManager = ComponentAccessor.getComponent(IssueSecurityLevelManager.class)
Project srcProject = issue.getProjectObject()
String currentUser = ((WorkflowContext) transientVars.get("context")).getCaller();
User currentUserObj = UserUtils.getUser(currentUser);
def wasIndexing = ImportUtils.indexIssues
ImportUtils.indexIssues = true
issueFactory = ComponentAccessor.getComponent(IssueFactory);
newissue = issueFactory.getIssue()
newissue.setSummary (issue.summary)
newissue.setProjectObject (projectMgr.getProjectObj(
def newIssueType = ComponentAccessor.issueTypeSchemeManager.getIssueTypesForProject(issue.projectObject).find{"Quote"}
newissue.setIssueTypeObject (newIssueType)
newissue.description = issue.description
newissue.reporter = issue.getReporter()
newissue.assignee = currentUserObj
params = ["issue":newissue]
subTask = issueMgr.createIssueObject(currentUserObj, params)
log.debug "DBG: " + subTask.getKey()

linkMgr = ComponentAccessor.getComponent(IssueLinkManager)
def sequence = 0
for (IssueLink link in linkMgr.getInwardLinks( {
if ("Quotes" == {

Collection<IssueSecurityLevel> issueSecurityLevels = issueSecurityLevelManager.getAllIssueSecurityLevels()
def secLevel = currentUserObj.getName() + "_only"
log.debug "DBG: secLevel=" + secLevel
String levelID=null;
for (IssueSecurityLevel issueSecurityLevel: issueSecurityLevels) {
String name=issueSecurityLevel.getName();
log.debug "DBG: " + name;
log.debug "DBG: " +;
Collection<IssueLinkType> issueLinkTypes = linkTypeManager.getIssueLinkTypes()
String linkID=null;
for (IssueLinkType issueLinkType : issueLinkTypes) {
String name=issueLinkType.getName();
linkManager.createIssueLink(,, Long.parseLong(linkID) , sequence, currentUserObj);
ImportUtils.indexIssues = wasIndexing


Any reason anyone can see why the security level won't be applied? And no error?



2 answers

1 accepted

0 votes
Accepted answer

Figured it out, if this spammed someone - my apologies.  The security level needs to be included in the params of the object passed to the issueMgr's method createIssueObject.  So I re-ordered the operations to set the security level on the newissue object before passing newissue to the create method.


Thanks again for any cycles spent on this.

0 votes

I've not fully understood the code here, but it looks like you are trying to set a security level on a sub-task?  Which you can't do, because sub-tasks always take their parent security level (even if you botch it into the database, the code ignores you)

Thanks for chiming in @Nic Brough [Adaptavist] - I'm not trying to create a subtask, just a linked issue... that section of code works even like this: params = ["issue":newissue] foobar = issueMgr.createIssueObject(currentUserObj, params) log.debug "DBG: " + foobar.getKey() But maybe you're onto something. Thanks again!

Ah, ok. Does the user executing the code have the rights to set security levels?

Interestingly, no. Since the parameters of the object passed into the create method can include a security level (see my answer below) - the user invoking the script need not have set-security-level privs in order for the created issue to have a security level. But create issue privs have to exist for this to work. What we have is a way for internal people to select from a list of groups of external people (vendors) and give them access to an 'RFQ' issue type. The selected vendors can each create Quote issue types that exclusively visible to them (and of course all the internal people). The vendors can see only their Quotes which are linked issues on the RFQ which they can see. We allow multiple vendors access to the RFQ, but they can't edit or comment on it. They can only create a separate, linked Quote issue that they are assigned to.

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Feb 07, 2019 in Marketplace Apps

A Timeless Love Story

It started as any story starts, on a normal, rainy day.   Admin meets App, and her name was Klok2, and like any first relationship we were both trying to make it work but neither one knew what...

448 views 8 26
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you