How can I restrict a user not seeing other projects when he creates an issue

[Romain Rochat]

Hi,

We are working on many project at a time, for different customers. We want to give external access to our customers, but only for a specific project. Rights and privileges seems to be fine as their projects are only visible.

But not when creating an issue, they can see others projects in the list. See below.

How can I change that?

[Jakub Sławiński]

Hi @Romain Rochat ,

you should also make sure that the 'Create issues' permission is correctly assigned (i.e. these customers do not have this permission in the project you want to hide from them).

[Romain Rochat]

Thanks both for your response. So basically I did it right with permission scheme. I just need now to change a litle in order to hide other projects when creating new ticket.

It means at the end that I would have to duplicate the permission scheme per "customer", and be sure to have specific customer group for "create issue" privilege.

[Joe Pitt]

I suggest using project roles not groups. Only one permission scheme will be needed. Project Leads can add the users to the role in their project

[Joe Pitt]

Project access is controlled by the permission scheme. 

First, by default JIRA has a horrible permission scheme that violates security best practices by allowing everyone that can logon to do just about everything.

JIRA works by GRANTING access. You can't restrict access. By default, it grants access to the group used to logon (see Global permissions to see the "can use" groups and admin groups).  This is where users are getting their access.

1. The FIRST thing you need to do to get control is to remove any groups with logon privileges from the permission scheme unless you absolutely want everyone to have that permission.
2. Then I suggest you setup Project Roles for the various functions like, tester, QA, Browse Only, etc.
3. By using project roles, one permission scheme will cover all projects. The project admin controls project role membership
4. If the project leads want everyone that can logon access to the project they can add the logon group to a project role with the desired permissions.

This may be a big effort, but it will pay off down the road by making it easy to control access.

Most of the 'old timers' use project roles. It meets the best practice for security and gives complete control to the project lead for access to their project. JIRA comes with many project roles, but you can add more if you have a special need.