Project Administrators could not remove users assign to another role with "Administer Project" permission

[Mary-An ylanan]

Hi,

We encountered below error when a user with Administrator project role try to remove users assign to another project role (e.g. Owner).

Error msg: "You can not remove a user/group that will result in completely removing yourself from this role."

Both project roles (Owner and Administrator) were granted with “Administer Projects” permission.

When the admin account is added as one of the Owners then he can remove existing owners except for himself.

Would appreciate if anyone can share your experience if you encounter similar issue.

[Alvis Yeo · Accepted solution]

Apparently, it was raised in JRA-29349 as a bug. Have voted to have it resolved.

On record as workaround (from JRA-29349) :-

There are two possible workaround solutions:

1. Use a global JIRA admin user account to perform the operation.
2. Add your user account in the Administrators roles before the operation.

[Nic Brough -Adaptavist-]

Thanks Alvis, that's the bug I was reaching for! I knew I'd seen it before, but needed to eliminate all the other possible errors (and I hadn't got this one bookmarked)

[Nic Brough -Adaptavist-]

It's not a bug, it's trying to stop you from removing all administrative rights and locking yourself out completely.

You need to ensure at least one person has admin rights over a project.

The usual trick is to change the permission scheme to say "Jira system admins have project admin rights", because you'll always have at least one system admin (it will also stop you removing the last system admin in general permissions) who can let you back in after you destroy your admin rights. I tend to avoid it myself - people should think before they destroy their own access...

[Alvis Yeo]

Hi Nic,

I am able to understand what you have explained but that does not seem to explain for my scenario.

We have a set of users in Project Administrator Role and a different set of users in Project Developer Role. And both Roles have Administer Project permission for that project

One user from either Roles cannot remove another user from the other Role. There are sufficient users in each Role and the user is not trying to remove him/herself.

And I certain do have jira-administrators (another set of users) in the the Project Administrator Role.

So in our context, it doesn't consistute to removing the last-man-standing-who-has-admin-rights. Haa.

I may not have understood your explanation fully to our situation but hopefully you could enlighten us =)

Regards,

Alvis

[Edited "Group" to "Role". My Bad. Used the wrong word in this comment]

[Nic Brough -Adaptavist-]

No, it seems you're mixing up groups and roles now.

Only jira/system admins can edit groups. The original question was about project admins editing role membership, and the error message you're getting is because your users are trying to remove members from roles in a way that would break the project.

The group memberships are totally separate from role memberships, you need to be very careful not to mix them up.

[Alvis Yeo]

Hi Nic,

We know the difference between groups and roles. As JIRA has introduced Roles back in v4 (i supposed). We have stopped using groups unless needed.

We are really facing issue on Role membership. (Sorry that I used groups in my previous comment. Suppose to be project role. I have edited to be consistent in order not to confuse viewers).

[Nic Brough -Adaptavist-]

Ok, I think that's more clear now, but I still don't quite understand the problem. It still sounds like someone in a group with project admin rights is trying to remove their group from the role of project admin, which would leave the project with no admins...

Could you share the basic setup and scenario please? Just the permission scheme line for "project administration" and then explain who is in any roles in there. Then, the exact setup of a user who is getting this issue.

[Alvis Yeo]

This is the setup:

Permission Scheme (Administer Project) contains:

• Project Administrator
• Project Developer
• Project Owner (additional project role we added)

Project Administrator role contains:

• User A
• User B

Project Developer role contains:

• User C
• User D

Project Owner role contains:

• User E
• User F

This is the scenario.

Steps to replicate:

1. User A received a request to replace User F to with User G.
2. User A removes User F and adds User G in the Project Owner role.
3. Click on 'Update' and receive error message.

Performing the same steps on User D in Project Developer role yield the same error message.

If User A adds himself into Project Owner role first. Remove User F. Adds User G. Click 'Update'. It will be successful without error.

[Alvis Yeo]

I am, with Mary-An, working on this reported issue by our users.

Would also appreciate anyone from Atlassian can confirm the behavior and whether this is a bug.