Users not associated with projects are seeing all project when creating an Issue

Question

I have setup a group of users and associated them with a couple of projects in my Jira on Demand instance:-

Complete list of projects - Harp, MASBAU, MASProjects, PC

List of project associated with the group MAS_Users - MASBAU, MASProjects

This works in that members of the MAS_Users group only see the two projects in the main project dropdown, and the permission denied message appears if directly trying to access an issue belonging to a not associated project like Harp.

My problem is when a MAS_User creates an issue, the projects drop down in the create issue pop-up shows ALL projects.  How can I suppress this to just the list of projects the user is associated with?

This is due to be launched to the client today, but we cannot release this with them seeing projects not associated with them.

LucasA · Answer

Hi Jerry,

I believe there's something missing in your instance's permissions. For testing purposes, I just an enviroment like yours in a JIRA 5.1.7 with the following parameters:

1) A "MAS_TEST" project (key MTP);
2) A "MAS_User" user;
3) A "MAS_Group";
4) On the Global Permissions, I added the "MAS_Group" in the "JIRA Users" role; 
5) Removed all the groups from "MAS_User" and added him only in the "MAS_Group" (removing the default "jira-users" group);
6) On the Project configuration, clicking on the tab "People", I removed the "jira-users" group from the "User" role, replacing it by "MAS_Group".
7) Double-checked on the Permission Scheme if the "Browse Project" permission was applied to the "Project Role (Users)".

After that, I  logged in with the "mas" user and it has restricted permissions to the "MAS_TEST" project -- it was unable to see any other project. And when creating an issue, only the "MAS_TEST" project was displayed for him as available.

So would you double check if you have set all this configurations in your OnDemand JIRA instance?

Best regards,
Lucas Timm