How to prevent an "jira-administrators" assigned user from installing plug-ins

[Mark Pelea]

To Jira Support,

We have users that are assigned with the "jira-administrators" group access.  We would like those users to perform their administrative duties except for installing Plug-Ins.

How do we prevent "jira-administrators" group assigned users from installing Plug-Ins?

I appreciate your assistance.

Thanks,

Mark Pelea

Email: mpelea@definitivelogic.com

[Andy Heinzer]

Hi Mark,

The global permissions are not granular enough to only limit the ability to install add-ons.  You can limit this, but when you do so, you are also limiting these admins from performing a number of other tasks within Jira, such as XML backups, configuring SMTP setting in Jira, configuring application links, etc.  There is a complete list of all the things system admins can do that non-system admins cannot and it is explained in Managing global permissions.

But if you decide to do this anyway, knowing this limits more than just addons, the steps to do so are pretty quick to complete. By default Jira's global permissions are the same for the Jira administrators as they are for the Jira system administrators.  Since only system administrators can install and/or upload addons to Jira, it seems clear to me that you just need to grant some other group access to that global system admin role and then you can remove the 'jira-administrators' group from that system admin global rights.   

1. First create a new group, call it something like "jira-system-admin"
2. Make sure you have added a least a few users here that are suppose to have access to install/update plugins as well as configure everything else within Jira
3. Then go to the Gear Icon -> System.  On the right side, under the security section, click the link for Global permissions.
4. On that page, add the "Jira System Administrators" rights to this new group 'jira-system-admin'
5. Once that is done, you should be able to then remove the 'jira-administrators' group from that specific permission. 

I just followed these steps in my own install and here is what mine now looks like:

[Mark Pelea]

Thank you, Andrew!

This works.

Thanks,

Mark Pelea