Field/comment visibility to certain group of users?

[Pietros]

We share our JIRA instance with a customer. Some comments/fields are internal, though - is there a way how to make these invisible for customers, e.g. based on the user group or something like that?

[William Crighton [CCC] · Accepted solution]

@Pietros -

Comments,  yes, though it's not the most intuitive interface available.

Fields? No. That's HUGE disappointment for a LARGE number of very VOCAL people all of whom seem most upset (IMSHO) by the fact that JIRA is stull HUGELY successful even without this 'fundamental' feature, That's not to say, however, that the problem hasn't been addressed by 3rd parties OR that there aren't any work-arounds available.

To start here's a query against the marketplace that will return 3 different plugins (of which I know little to nothing about AND am quite unaffiliated with in any way):

• [query to look for field level security addons in the atlassian marketplace|https://marketplace.atlassian.com/search?q=field+level+security]

If that's not acceptable then there are some options. Another paid option I know about (because we're the vendor) is the JIRA Confluence Issue Macro which allows you to publish the contents of JIRA issues in whatever format you desire on confluence pages. This would keep the customer from being able to 'game' the search engine to view the options available for different fields, etc.

• [You can read more about that plugin here|https://marketplace.atlassian.com/plugins/com.capitaladdons.confluence.plugin.macro.ca-jira-confluence-issue-macro]

Finally, the only thing I know of and it wouldn't work all that 'cleanly' would be to have each custom request issue made up of two actual JIRA issues, the first with an open security level (the customer facing issue) and the other an internal only security level.

You never provided a JIRA version or install type so I'm going to assume mid-level 6 JIRA server install. and with that you can get script-runner installed which will handle many of the needs you have - setting that security level correctly in an automated fashion, among other things.

Hope that helps.

-wc

[Pietros]

Could you please elaborate on the Comment visibiltiy setting?

[William Crighton [CCC]]

Sure - via some links to Atlassian Doc - the first one talks about the general configuration options which has one entry related to comment visibility - here's the link, followed by what text to search for when you get to the page (just do a page find for the text): * https://confluence.atlassian.com/display/JIRA/Configuring+JIRA+Options ** Comment visibility This next link talks about how to modify the default visibility of the comment restricting it to a project role or a group (depending on how you setup your config in the first link): * https://confluence.atlassian.com/display/JIRA/Commenting+on+an+Issue#CommentingonanIssue-addcomment Finally, there's a few solutions running about which are pretty easy to apply but require modification of JIRA Core code - meaning you'll have to re-apply the changes every time you upgrade. However, it might be worth it to you as the change allows you to specify a default level of visibility for each comment created - meaning with this change you can specify that every comment is only visible to 'internal' people unless someone goes and modifies the role/group which can view the comment. - don't get offended, it's just way easier to give you a short url this way instead of trying (and failing) to get the confluence editor to handle the markup correctly (or handle my incorrect markup correctly): * http://lmgtfy.com/?q=atlassian+jira+configure+%22comment+visibility%22 I usually only send people to lmgtfy when I'm fuckin with them because they ask me a question they should have asked google - not the case here, just so you know. The first 5 links look pretty good - I put two of them in my answer and the other three are all about the 'modification' fix

[Pietros]

Thank you very much! So it would be possible to - when entering a comment - make it visible just for a specific group?

[William Crighton [CCC]]

yes, absolutely. The 'trouble spots' there are that you cannot set a default group w/o modifying code (which is truly a pita if you stay close to current with 2-4 upgrades a year) and the default is world readable. Makes me think....someone should fix that...