Customer group with AD and Crowd: only allow portal access

[hamishEd Administrator]

I've set up Service Desk, and am using Crowd linked to Active Directory for user management. I have 3 AD groups which are pulled in to Crowd and used within Jira:

Service Desk Admins
Service Desk Agents
Service Desk Customers

I'm trying to grant the Service Desk Customers group permission to log in to portals, but not to log in to the main Jira instance and see dashboards etc., as this seems to expose information about what's going on in the whole Jira instance that I'd rather they couldn't see.

I removed the Service Desk Customers group from the application in Jira, which prevents these users logging in to the main dashboard. But it also prevents them logging in to the customer portals for any of my projects, even if I explicitly add this group as customers in the project settings.

What's the best way to handle this?

[hamishEd Administrator · Accepted solution]

Just to update this issue, it appears the mistake was mine.

I re-added the Customers group via Crowd so they're able to log in to the Jira Service Desk application, and after also adding the group as customers within each project, they now can't view the system dashboard and are automatically directed toward the Help Center.

[Victor Mutambuki]

Hamish,.

See topic on What is a customer 

Also, checkout the topic on Customer Permissions.

Victor

[hamishEd Administrator]

Hi Victor,

Thanks for your reply. I'd looked over those articles but couldn't quite work out how to achieve what I wanted. I hoped that adding the AD groups passed through from Crowd as Customers per project would work, but I think the fact that they're added through Crowd is causing the issue.

If I grant the Service Desk Customers group permission to the Jira application within Crowd, they're able to log in and see dashboards. But if I don't add them this way, they can't log in at all even when the group is added in the Customer role within Service Desk.

I'm a bit lost as to how I can use a group added within Crowd just for customers, without granting them rights to the whole Jira instance. I'm sure I'm missing something really obvious, but if anyone with a similar set up could walk me through how to achieve this it'd be a great help.