Issue security - Must be a member of Group A, B & D

[Daniel Garcia]

I have a requirement to restrict access to issues based on the overlap of multiple groups

e.g. I might have a checkbox list

• Option A
• Option B
• Option C
• Option D
• Option E

If Options A, B & D are selected then only those users in the overlap (intersect) between Groups A, B & D can view the issue. IOW a user needs to be a member of all 3 groups in order to view the issue.

One way of achieving this is programmatically creating 2^n issue security levels where n might be 15 (ouch!) then setting the issue security levels in an update listener based on the selected checkbox option. There are so many things to dislike about this approach.

If 2 or more selected options is uncommon, the overlap between groups is small and group membership is relatively stable, another approach would be to create 15 issue security levels + 1 extra for when multiple options are selected. The 16th option could reference a multi user picker where every allowable user is selected based on the overlap. Again this could be done in an event listener. I'm not really happy with this approach either.

Is there a way to create a dynamic group provider that could be assigned to a security level?

Is there a way to deny access to different groups?

[Ivan Tovbin]

Hi Daniel,

I think something like this is possible. This is how i see it:

1) Create a group which will be dynamically populated with users that are supposed to have access to your issue. Let's call it 'security group'

2) Create issue security scheme and configure it to give access to your issue to all people in your'security group'

3) Now the tricky part. Create a script listener which will trigger on 'Issue Updated' event. The listener should check the actual values of your checkboxes field. Then it should check the existing members of your 'security group' and remove those that do no intersect will all checked groups. Also it should check all the checked groups and add intersecting members (if any) to your 'security group'.

If you need help with the actual code, let me know.