Customer can see other Projects and all members - How to avoid that?

[Axel]

Hi guys,

I have a problem, which won't allow me to use JIRA with our customers, if it can't be resolved. I already searched the web, youtube and asked a friend who is a Jira Admin in his company. He even couldn't help me, because they don't use JIRA for  the same purpose.

I have managed to create every Permission according to the manuals from Atlassian and othe guys.

A test-customer like Kevin on the Jira Video is able to only see the project regarding his company.

That's a yay!finally! here.

BUT:

When this test customer wants to start a task he is able to see:

1) All of our Projects in which he can choose to assign the task with all of our other projects (internal and external).

2) He can assign the task to any member of our JIRA System, so all other customers and all of our team members.

Hopefully someone will help me here, otherwise I need to search for an other solution

thanks in advance

[Bastian Stehmann]

Hi @Axel,

if the Testuser can create issues in other projects, you should check the "Create Issue" permission in other projects. If the Testuser has permission to create an issue in an project, he can select it on the create issue screen even if he can not see that project.

You can restrict the users, that can be assigned to an issue by setting the "Assignable User" permission. If you add only the project roles there, only users, that have one of these roles will be available for assigning.

[Alexey Matveev]

Hello,

You should check the Browse Issues permission for the project which must not be seen by users. You should remove the users from any group or role which is set there.

You can read more about permissions here:

https://confluence.atlassian.com/adminjiraserver073/managing-project-permissions-861253293.html

[Axel]

Hi @Bastian Stehmann and @Alexey Matveev,

thank you both for your very quick responses.

The solution was a mixture of both:

First I needed to delete the User from Creating Issues in the project related Permission Scheme.

Second I needed to delete "any logged in user" from the other Permission Schemes :)

Great!