Customer's can specify approvers who don't have a Jira account

[Sam Terezakis]

I have a 'team managed' service management project. An issue type's workflow has an approval step set to 'customer selects approver' and the approval field set to the system generated 'approvers' field. 

There appears to be no options to edit the options within this field. 

This option allows customers to add their own approver by specifying an email, even if they do not have a Atlassian account within our instance. 

This has resulted in customers (1) entering incorrect email addresses and (2) adding users that do not have a profile within our instance, which requires an agent to manually change the approver. 

Can the approver list be restricted to users (or a subset of users) with accounts on our instance?

[Marc - Devoteam]

Hi @Sam Terezakis 

I can reproduce this.

It seems related to JSDCLOUD-11150 

I would suggest to raise this as a bug at Atlassian Support, or ask if this is intended like this.

@Jack Brickey @Joseph Chung Yin @Mikael Sandberg would this be something you would have information on?

[Mikael Sandberg]

I don't think the Approvers field can be restricted, and I don't think that you could use a custom user picker field since you would need Browse users and groups global permissions which cannot be assigned to portal only users. The only workaround that I can think of, besides not allowing your customer to select the approvers, would be to have a custom field with a list of users that can approve.

[Marc - Devoteam]

Hi @Mikael Sandberg 

Thanks for the response.

But it still seems strange to me the option is there and then you are just able to add an email address real or fake to enter in the field from the portal.

Might you be able to raise this at Atlassian, as this can maybe also be exploited in a way.

[Mikael Sandberg]

I don't work for Atlassian, I am just a customer just like you. But I think this might be based on the customer permissions too, since you can set it so the customer can share the request with anyone.