manipulate connected user in JIRA Issues Macro

[Alexander Richter]

This question is in reference to Atlassian Documentation: JIRA Issues Macro

Hi there,

i would like to manipulate the JIRA Issue Macro via Source Editor, so the issue will be loaded not from current User.

UseCase: We want to show a Matrix view in Confluence for Customers, who have not the permission to show the specific issues in JIRA. So when looking at the Confluence Page with JIRA issue macro, they get an error, because they are not allowed to see the issues.

I think about manipulating the JIRA Issue Macro, to load the issues with a admin user.

here is the snippet of the source editor:

<span style="color: rgb(255,255,255);"> <ac:structured-macro ac:name="jira">
                          <ac:parameter ac:name="server">Jira</ac:parameter>
                          <ac:parameter ac:name="jqlQuery">project in (JPWP)<ac:parameter>
                          <ac:parameter ac:name="count">true</ac:parameter>
                          <ac:parameter ac:name="serverId"></ac:parameter>
                        </ac:structured-macro> <sub>0</sub> </span>

is it possible to add a parameter that tells the macro to load issue with a specific user?

Best Regards,

Alex

[Rob Woodgate · Accepted solution]

Hi Alex,

Your solution is ingenious, but probably over-complicated for what you actually need.

The simplest way would be to allow Anonymous users, and give anonymous users view permissions. 

If you can't do that and your customers have their own Confluence logins, create a group called (something like) "jira-customers" and give that group read access to the projects that the customers should be able to see.  If you have multiple customer groups, each of which should have access to different projects (and not the projects that other customers can see), create a group for each customer group and set the permissions accordingly.

[Alexander Richter]

Hi Rob,

thanks for your suggestion!

I forgot to mention, that our customers also have JIRA accounts, but definately should not see the issue we want to show via Confluence in JIRA.

If i give read permission, they could access the issues in JIRA.

[Rob Woodgate]

Hi Alex,

Based on what you've said:

Your customers can access JIRA, but they don't have permission to view certain issues in JIRA. 

You want to show them an issue (or list of issues) in Confluence using a JIRA macro, but this issue (or list of issues) will be one that they don't have permission to view in JIRA.

If that's right then I don't know how that can be done.  The big use case for Confluence and JIRA integration is to allow users to report on, and click through to, JIRA issues.  If you can see the issue in JIRA then you can see it in Confluence.  If you can't see it in JIRA then you can't see it in Confluence. "They can't see it in JIRA, but they can see it in Confluence" is not possible for a single user.

Perhaps there's someone here with more experience of JIRA's multiple layers of permissions who can fashion you a workaround...?

Failing that, you could build the report on a page with restricted access, take a screenshot of the results and attach that screenshot to the customer page.  It's not dynamic, but it will show them the information.

If that's not an acceptable compromise then you'll need to work out whether it's more important that customers can see the items in Confluence, or that customer can't access the items in JIRA, because you can't have both.

[Alexander Richter]

Hi Rob,

you exactly pointed out the problem.

And i am totally aware of how the permissions in and between JIRA and Confluence work.

That is why i wanted to try, to load data in Confluence over a specific User.

Maybe it is possible with some coding, but for that my experience is not enough either.

[Rob Woodgate]

Now that I understand the problem your initial approach makes more sense (and is still ingenious:-))

In practise you'd essentially have to hijack a user token and use it instead of the real user's token, but just for the one page that's got the JIRA items on.  And then jump back to the real user's token if they tried to click on an issue, to prevent them being able to access it in JIRA.  I'm guessing this is where you've got stuck?  Unfortunately that's a problem that probably can't be solved.

However, rather than worry about permissions it should be possible to create a macro that displays issues but doesn't use the onclick event to take the user to JIRA.  So you could report on the issues, but nothing happens when the user clicks on an issue.  The macro could by default use the credentials of a user who has view permissions for everything in JIRA. Would that be an option?  If so you should be able to find a developer or Atlassian Expert to create that for you....

[Alexander Richter]

yes that is maybe an option, shouldn't be that complicated though

thank you for your support, appreciate it!

[Rob Woodgate]

Good luck.  If you create a macro you might want to consider putting it on the Atlassian Marketplace for others who have the same requirements