Best practice between "Permission Schemes" and Project Settings "People/Project Roles"

[Steven Lloyd]

Hi,

I was recently came across an issue in which a user was able to see a Project in Jira which in they didn't need to have access to.

I primarily use Permission Schemes for projects created in JIRA to set and allow User Groups functionality within specific Jira projects. The user in question was not in any browse or create groups within the permission scheme for the project in question but was still able to view. After some digging around I eventually found that a user group had been added to the "People" section within Project settings which was allowing the specific user to browse and create in said project, by a previous administrator.

I've done some looking into both "Permission Schemes" and "People" after coming across this and can't really seem to find any difference between the two. Is there a best practice in which people use permission schemes and people to create specific project permissions or do the two just give similar functionality. Is it more for ease of managing within People with it being between Administrators or developers. Rather than a more granular level within a permission scheme?

As mentioned above, I am more accustomed to using permission schemes and associating these to specific projects but a previous Admin seems to have used the "People" setting on some projects and not others and I cannot think or find online any benefits to one over the other.

Apologies if there are open discussions or pages discussing this topic but some searching around the topic haven't really returned any best practice or over sweeping answers.

Additionally it may be that I was searching for "People" rather than "Project Roles", and that after some additional research into this after posting the question is that, project roles can be managed by project administrators rather than JIRA Administrators, but if this is the case, is it then easier to have a global permission scheme for every project within a Jira instance which is set to Jira Administrators only, and then project roles used within each project and managed by project admins. Rather than having a specific permission scheme for every project created? It just seems to be duplication unless permission schemes aren't used along side it.

Any help with this would be greatly appreciated.

Steven

[Richard Fay · Accepted solution]

I think you answered your own question. The primary difference is what level of admin access you need, in case you want to delegate project-level config to a different user. If you are doing all of the config, it's really up to you.

My preference is for a standard Permission Scheme for all similar projects, and then using project roles to give individuals or groups specific permissions. For instance, we have a Developers group, so I typically assign the group to the Developer project role so I don't have to micromanage user permissions. When we get a new dev, I add them to the group, and they are all set across all relevant projects.

Go with what works for you.

Cheers.

[Steven Lloyd]

Thanks for the response Richard,

I thought as much with what I had found initially, that it was whatever works best, just with both options available I wanted to make sure I was on the right track with it all, and there wasn't something specific that I was missing by not using one or the other.

Cheers.