How do I restrict projects for certain user-groups?

[SimonS]

I am reaching out to you for assistance in setting up a directory for external users outside of our company that they can use to gain access to our Jira site and see only one project. Currently we have access and project assignments based on our active directory groups. I want to set up another group directory that allows me to manage people outside of our company. Is this possible? My goal is the following:

1. Set up additional directory.

2. Put external users in this directory.

3. Allows external users to gain access to our site.

4. Manage what projects these external users can see.

I have gone through your user documentation and cant seem to find the questions I am looking for. If this requires many steps I would like to conference call with you so that you can take me through the steps.

(filed on behalf of a customer -Simon)

[SimonS · Accepted solution]

The first step is to add the external users to your Active Directory instance. Create a new group named something like "external users" and add all of the users you wish to manage to this group. The group and its members should automatically appear in JIRA.

At this point, these external users can log in and see all of JIRA - we need to restrict which projects they can see. This is done in three steps: creating and assigning a new permission scheme, adding the "JIRA user" permission to the external-user group, and assigning the permission scheme to the projects. First, let JIRA know that the new external-user group can log in to JIRA:

1. Log in as a JIRA administrator.
2. Click the "Administration" link in the upper-right hand corner
3. In the "Users" section, click on the "Global Permissions" link
4. In the "Add Permission" section, select the "JIRA Users" permission and the external-user group. Click 'Add'.

Now, create a new permission scheme:

1. Click on "Administration." The General Administration screen appears.
2. Near the bottom of the page, in the "Issues" section, click "Permission Schemes."
3. The Permission Schemes page appears. You should only need to make one change - click "Copy" in the row of "Default Permission Scheme".
4. Click on "Copy of Default Permission Scheme"
5. The second row should be "Browse Projects." Click "Add" in the "Operations" column.
6. Select "Group" and select the external-users group from the dropdown. Click "Add."

Now, restrict this group to individual projects. For each project that you would like the external users to be able to see:

1. Click the "Projects" dropdown and select the appropriate project
2. The project admin screen appears. In the "Permissions" section, click "Default Permission Scheme", or whichever scheme you have applied already
3. Click the "Actions" gear icon in the upper-right hand corner. Select "Use a Different Scheme"
4. Select "Copy of Default Permission Scheme." Click associate

You should be all set - try logging in as one of the users in the external-users group. They should only be able to see the projects you have applied this new permissions scheme to.

-Simon

[Patrick Francis]

The one caveat here is that ANY new users will also get added to the external group, as it has global permissions. The admin adding new users must remember to remove new users from the external group or risk exposing the external client's issues to an audience that is not meant to see them. If there are new users added regularly, or external users added regularly, this presents a real nuisance for the JIRA admin.