Permission issue when using Confluence as a KB

[Yan Chen]

Hello,

We've integrated the Confluence as a KB with Jira Service Management, but we found the access permission is out of control on the KB side if we have more than one JSM project.

Like we have JSMPROJ1, JSMPROJ2 on the Jira side with the different user roles, and created JSMPROJ1, and JSMPROJ2 on the Confluence side as KB for those JSM projects. The user permissions work as expected on the Jira side that users could only access the service types as they assigned, but they could able to access all the KBs on the confluence side, doesn't matter they've been assigned to the specific project or not.

Is there a way to only allow the users who are listed in the Users and roles in the JSM project to access the specific KB?

Thanks!

[Kishan Sharma]

Nic has rightly suggested about the combinations you can set up to make this work. Eg: You can create JSMPROJ1,JSMPROJ2 in Jira and CNFKB1,CNFKB2 in confluence and add the same users in those Jira projects and Confluence spaces. Then link JSMPROJ1 to CNFKB1 and so on. You can also set restrictions on the confluence side so that only agents can see specific KB articles and other users can see the ones created for them.

[Nic Brough -Adaptavist-]

There are two ways for a person to get access to a knowledge base space, and it is unclear which method you might be talking about here.

1. Jira service management customer users get access to the knowledge-base linked to the portal(s) they can use.  These customers need not set up in Jira or Confluence with roles or permissions, they are set as customers in the service-management project.

2. Confluence users can have access to the KB, by being Confluence users.  Their access has nothing to do with their Jira access, they have to be Confluence users with access to the KB space, like it's any other space in Confluence

The important bit here is that Jira users (not customers) do not get Confluence access directly.  They have to be Confluence users as well.

I suspect what you need to be doing here is looking at the type of users.  For example, a set of people might be:

Alice:  JSMPROJ1 customer:  Can create and work with Requests in portal 1, and see articles in the JSMPROJ1 Knowledge base

Bob:  JSMPROJ1 Jira user, and a customer of JSMPROJ2 - Bob has access to issues in JSMPROJ1, and requests and the KB for JSMPROJ2.  But, because Bob is not a Confluence user, they do not have access to the KB for JSMPROJ1.

Charlie: JSMPROJ1 Jira user, and a customer of JSMPROJ2, and a confluence user, with access to the JSMPROJ1 space (Knowledge base).  You can see where this is going...

(Note also, you can set up a user with combinations here - it is possible for someone to have all three types of access - you can add the same account as a JSM customer, A Jira user and a Confluence user)

[Yan Chen]

Hi Nic, 

Thank you for your reply. 

The scenario looks like this:

JSMPROJ1 and JSMPROJ2 and their KB were both created on the JSM side.

JSMPROJ1 Customer: Alice, Charlie

JSMPROJ2 Customer: Bob, Charlie

We did not add any JSM customers as confluence users.

The problem is that if Alice clicks a KB article in the JSMPROJ1 portal -> click "View article in new window" on the bottom of the page, then Alice will be redirected to the Confluence and could able to access all the KB Spaces created with the JSM, including JSMPROJ2, even if Alice not a customer of JSMPROJ2.
The goal we need to achieve is that the JSM customers could only access the KB of their own Projects. e.g. Alice could only access the JSMPROJ1 KB in Confluence space, Bob could only access the JSMPROJ2 KB in Confluence space, and Charlie could be able to access both JSMPROJ1 and JSMPROJ2 KB Confluence space.

Thanks!