Prevent the modification of a specific role in a project

[Simona Persico]

Hi all,

i'm trying to understand how to prevent also to project administrators add/remove users on a specif role in the project. I'd like to populate this role only via listener and i'd like that noone could manually modify users associated to the role. It is possible? SOmeon has some idea?

Thank you

simona 

[Joe Pitt]

If you can't trust the project admins you have the wrong people in the job. The fact you're trying to manage the roles centrally also indicates to me they are the wrong people or management is into micro-managing people. Trying to work around an issue as simple as 'just don't do this' for a small number of people, in my opinion, shouldn't be done. 

[Simona Persico]

Hi, I have found a solution, thank you! 

I have created a listener that on the event RoleActor changed update the role of the specific project with the correct people.... 

simona

[Daniel Eads]

Hey Simona,

I'm aware of Delegated Project Admin - an addon that lets you proxy specific Jira Administration tasks to privileged users. Having a look through their documentation shows that those users must all be Project Admins though, which still lets them control who is in the roles for the project.

One way to get around this (although not ideal) is to use a permission scheme that doesn't use project roles at all and only uses groups.

Project administrators don't have permission to change group memberships in Jira OR to modify permissions for shared permissions schemes, so this might get you what you're after. You could then use a plugin like Delegated Project Admin or the script you mentioned to modify the group memberships. This approach can lead to some headaches in project administration for you down the line, but it is a solution if you need that much control around your projects.

As a former Jira admin though, I'd go with trying to improve training for your project administrators. It makes their lives easier when they can do simple functions (like adding people to their projects), and makes your life easier by not having to administer a complex setup.

Cheers,
Daniel

[Joe Pitt]

You can't. The project roles are designed to by managed by the project administrator.  this is a training issue. A couple days off without pay should help their memory.