Issue with User Picker field in a restricted project.

[ali]

We have an "User Pick" field setup in a Project, named "Manager"
It is a Single User Pick type, and had been assigned to Issue Creation, Form and Automation. A pickable group is also assigned to the Contexts in Custom Field settings for Manager.

This project is restricted, and should only be accessible by HR Personnels.

The issue are we experiencing are.
1) when trying to create a Ticket by filling out the form in Service Portal, no user was shows up in the drop down when we type in an user we knew he/she is in the group. The only people that will show are someone who had assigned some default roles in People under that Project Settings.

2) When trying to create a Ticket with the direct link to the form, Users are showing up, but when click on the Create button, it shows a message, "

We couldn’t create your issue.

Your request could not be created. Please check the fields have been correctly filled in. Please provide a valid value for field 'Manager'

Still, only people had assigned a default roles in People could get thru that ticket creation.

3) When Trying to create a Ticket in JIRA directly, not from the direct link to the form, not from the Service Portal, but directly from JIRA, click on the Create button, and fill out the required field, which including the Manager field. This works as expected.

In Case 1 and 2, we can either make it "not required" or pick someone that had assigned a default roles in People, to pass thru the creation step, and update the manager to the correct user by editing that ticket.

I don't understand why seems working normal in JIRA, but not from the Service Portal.

What should I check to fix it for the Service Portal?

Thanks a lot,

[Mikael Sandberg · Accepted solution]

Are you allowing your customers to search other customers within either their organization or project? Check your customer permissions under Project settings. If you are restricting this then what you see is expected, since customers, either from the portal or the generic form URL may not have access to view internal users. The reason that it is working when using the create button from within Jira is that you then already have browse permissions to the project and therefore can see internal users. 

[ali]

Thanks for the detail Mikael,
Here is what in the Customer permission.

Is this looks ok? and/or we need to check something more?
Thanks a lot,

[Mikael Sandberg]

That looks correct. If you change the channel access to public, I assume that the field works as expected correct? You may still run into issues on the Form since it does not support group context so it would still list all your users.

[ali]

That's correct Mikael,

If we change the Channel access to Public, then everything seems working fine.
But we would like to restrict the access, since that is a HR project, we don't want to open to everyone.

The other option would be open this project up, but restricting browse, creation permissions from the Project Permission, if that's the way to go.

Thanks,

[Mikael Sandberg]

Yeah, user picker fields are tricky when you want to restrict the project, since that will restrict what customers can see. 

The way I work around it in our HR project is that I use issue security instead, that way we can control who have access to specific requests. Some requests are locked down to only allow the People team and the reporter to view, others (like onboarding/off-boarding requests) are open to external teams.

[Mikael Sandberg]

Another option would be to utilize Assets, you could then have all your Managers in there as objects and then use an assets field instead, since that does not have the same restrictions that a user picker field has when it comes to restrictions.

[ali]

Thanks for the ideas Mikael,

Will test them out tomorrow.

Thanks a lot again.

[ali]

We goes with Issue Security, and open up the project.
This fixed the issue.

We also hide the project from Service Portal, so that people can't access the form in the Service Portal,

We tested, even if an user don't have access to the project, they still can fill out the form and submit from the Service portal, Hiding the project in the Service portal solved it.

Thank you @Mikael Sandberg for the idea.