How do permissions and workflow conditions interact?

[Mary Peek]

I have a user who does not have the Close Issues permission in the permission scheme. She's using a workflow that has no conditions on the Close Issue transition (i.e. no checking for the Close Issues permission). As expected, she can see the transition button to close an issue. And she can close the issue. But I would have expected her not to be able to close the issue since she doesn't have the Close Issues permission from the permission scheme. Even though the workflow gives her the ability to execute the transition I thought JIRA permissions from the permission scheme would stop her. Do you have to have both set? How do permissions and workflow conditions interact?

I'm using JIRA Software v7.4 server.

[Steven F Behnke · Accepted solution]

Things have changed over time. 

In JIRA 6.3 or6.2, Atlassian added a new permission called 'Transition Issues' permission. This is what is being checked now.

You can use the Close permission just like you could in Classic Jira. Add a condition to the Close transition, choose Permission Condition, then select Close Issues permission. 

This will get you the desired output in older and newer versions of JIRA. Effectively you need to apply the conditions to the workflow yourself, JIRA has no concept of a 'close' transition. 

[Mary Peek]

So being able to execute the transition (with the Transition Issues permission) which contains an Issue Closed event in the post function, actually closes the issue. Even though she doesn't have the Close Issues permission in the permission scheme. So the combination of all this trumps the Close Issues permission? I always thought that if you did not have the Close Issues permission then you couldn't close issues. I guess, as is often the case, it depends!

[Steven F Behnke]

The Issue Closed event really only ties a specific notification template to that event. It doesn't indicate to JIRA that the conditon needs to be permission protected. Permissions and Events are not related to each other.

It has always been the case in JIRA that you needed to apply the Permission Condition: Close Issues Permission to the appropriate Transitions.

If you had to have Close Issues permission close issues in the past, that means you were either using the Default JIRA Workflow (which uses these conditions by default) or you had an Admin that used the Permission Conditions on custom workflows.

JIRA does NOT do the work for you. Again, you can name a transition ANYTHING you want. JIRA can't possibly know that a transition named "ajsdkfdsafk" leading to a status named "asfdsijvsaf" needs to be protected by a Close Permission. You must provide this framework by using the existing conditions/permissions on your custom workflow.

[Steven F Behnke]

Before the "Transition Issues" permission, if you didn't use the permission conditions, even logged out users could execute transitions. This was more fragile before the "Transition Issues" permission was released.

[Mary Peek]

Thanks!

[Steven F Behnke]

No problem at all! I love talking JIRA.