Why are my JSM customers showing up in the Project Lead selection list in my Jira Software projects

[njk42]

My company uses Jira Service Management and has an extensive list of external customer contacts in our database who have requested tech support. 

Our software development team also uses Jira Software for internal development (bug tracking, etc).

I was just made aware that our JSM customer contact emails are being listed as available assignees as Project Leads when configuring the settings on a Jira Software project!

Is this leakage a bug?  Is it intentional by design?  If intentional, is there a way to disable the "cross-contamination" from JSM customers who should NOT have any access or insight into our internal Jira projects... certainly should not be assignable as a Project lead.  Ultimately the Jira Software users on our internal software team shouldn't have any visibility into the JSM customer list unless they have permissions in both products, right?

Thanks!

[Susan Waldrip]

Hi @njk42 , have you checked your permissions and permission scheme(s)? Sounds like there's a Project Role or Group that may have permissions you don't want them to have. Permissions schemes are at Settings (gear) > Issues > Permission schemes.

At the Project level, check Project settings > Access > Project permissions for a Project Role or Group for your external users.

[njk42]

Thanks Susan - I'm familiar with and able to get to the permissions scheme pages for both the project settings and the more global level... but it's not clear which of the particular permission items is responsible for controlling "Project Lead" assignment.  There are permissions for Administer Projects, but this doesn't seem to be the same as being assignable to Lead a single project.  When I search the permissions scheme page for the word "lead" nothing is found.  Thanks!

[Marc - Devoteam]

Hi @njk42 

Can you show screenshots.

What type of project is the project for internal development a JSM project or a normal JIra software project?

If a normal Jira software project, what does the permission scheme state on the assignable user permission and on other permissions?

My guess its in the permission scheme, amend this to your needs.

[njk42]

A screenshot of the page where Project Leads are assigned would have to be largely redacted so not sure how helpful it would be.  It's essentially a selection list of people which I would expect to be populated only with internal people in Jira Software, but it includes them PLUS all of our customers from the JSM project. 

The internal project is a standard Jira Software project. 

The project permissions are the "Default software scheme", so I'm a bit surprised that this behavior would be enabled by default, but I will try to understand these schemes more and hopefully be able to disable the JSM customers from showing up in this list. 

AFAIK, a customer assigned as a Project Lead still doesn't have any actual access or notifications related to the internal Jira Software projects, but it's still a bit concerning that they even show up in the list and can be assigned as a Project Lead. 

[Marc - Devoteam]

Hi @njk42 

On software projects a license is required to even be able to use this part of Jira and then a user would still need to be granted browse permissions on a project (based on role, group or user) 

To see the issue.

But using the ootb permission scheme is not a best practice, as this always ootb contains all users or all logged in users on permissions.

[njk42]

Yes, understood - we have only licensed internal users/developers accessing our Jira Software project.  That's another reason why it was so strange to be seeing our customers from the JSM project in the list of available Project Lead assignees for the internal Software projects. 

[njk42]

Also interestingly, our customers from JSM are (correctly) NOT listed as targets for the assignable user on Issues in the Jira Software projects, even though they are assignable as Project leads.  I don't see anything in the permission scheme which indicates that a group or role which contains JSM customers have any additional permissions to administer/lead projects, so I'm becoming further convinced that this is a possible bug when the list of available Project Lead options is rendered on the Project Settings page. 

[Marc - Devoteam]

Hi @njk42 

Aha do you mean the project lead option on a project itself?

If this is the case, this is just a field for setting the project lead, this doesn't grant any permission or else.

This is just a field other users could you to find a contact for this Jira project.

[njk42]

Yes, confirmed that I'm not really concerned with actually giving permissions to customers or external users when assigning them as a Project Lead... since they are unlicensed. 

But it's still disconcerting to have them even listed as assignable as Project Leads when they are both external users and also associated only with the JSM projects (and not the Software projects. 

If I have an internal developer or manager who goes to create a new project and wants to assign a Project Lead for that project and sees a list of hundreds of customers instead of just the internal users, it raises questions about actual access rights, whether customers will get email notification that they were assigned as a Project Lead, etc. 

[njk42]

And thanks for your help Marc!