Can I restrict changes on the Assignee field to Project Admins?

[Trudy Claspill]

Using JIRA 7.3.6 and Adaptavist ScriptRunner v5.1.6.

I want to prevent the Assignee field from being changed except by Project Administrators.

I found this article in the Adaptavist site about making a field read-only, and applied that to the Assignee field.

https://scriptrunner.adaptavist.com/latest/jira/recipes/behaviours/field-readonly-except-role.html

I then tried to change the Assignee on the applicable issue while logged in as a user that is not an Administrator for the project.

When I clicked on the Assign button in the Issue Details view, the Assignee field was indeed disabled.

However, I was able to click on the Assign To Me link, and the Assignee on the issue changed.

Why doesn't the Behaviour affect the Assign To Me functionality? 

Is there another way to accomplish this?

[Tuncay Senturk · Accepted solution]

Hello Trudy,

Another solution (without using Script Runner) is to modify workflow for those issue types.

1. Remove Assignee field from Edit Screen (No one will change assignee anymore)
2. Add a transition for every status to itself again (e.g. Open to Open)
3. Add transition screen which includes Assignee field for this transition
4. Add a workflow condition to restrict this transition to only Project Administrators

I know, this is tricky and adds a useless transition to the issue history, but it will help you achieve preventing assignee changes from every channel (UI, REST, ..)

[Trudy Claspill]

Hello Tuncay,

Thank you for that suggestion. We have actually already implemented that.

The workflow modification does not prevent use of the Assign button nor the Assign To Me feature. Those are the two features I am trying to block for all but Project Administrators, for a subset of issues types in just one project.

[Tuncay Senturk]

Yes, you're right.

Actually one of our clients wanted such a feature and we implemented it for them with a custom plugin.

If you have ability to write your own plugin, I can share the code for you.

[Trudy Claspill]

I found the way to block the Assign To Me and Assign button features.

Besides using the workflow transitions mentioned by Tuncay, I also used Properties in each status:

Property: jira.permission.assign.projectrole

Value: 10002

This limits the access to the Assign button and Assign To Me features in each status to the Project Role with ID 10002 (which is the Administrator role in our project).

[Nic Brough -Adaptavist- · Accepted solution]

The behaviour script is not aware of all the different ways Jira might be doing things.  The assignee is a field, but the assign-to-me is a separate UI element.  You'll need to create another one to get rid of it.

But, you might not need to.  You could skip Behaviours entirely, and just use the permission scheme.  If you set that up with "assign issues:  Role:  Admins" (assuming you are identifying the project admins with that role), then that will make the field unchangeable and hide assign-to-me for you.

[Trudy Claspill]

Thank you for the suggestion, Nic, but I can't do this through the Permission scheme.

I want to apply this restriction to a subset of issue types in the project. The permission scheme applies to all issue types.

I will look again at the Adaptavist documentation for information on getting rid of a UI element.

[Nic Brough -Adaptavist-]

Ok, that's a pain, but it is not going to stop you.

To do this, you will need (at least) two workflows.  One for "anyone can assign" and another for "only admins".

In the permission scheme, grant both sets of people the assign rights.

In the workflow for "only admins", use a workflow property (you'll want to add this to all status) to say "only admins have permission to assign issues)

[Trudy Claspill]

Thank you for that suggestion, Nic.

We already have a unique workflow for these issues we're trying to restrict, so that won't be so hard to implement.

I wasn't aware of the workflow property option for this.

Do you happen to have a link to any documentation that lists the workflow properties that are available?

(Nevermind, I found it.)  

[Trudy Claspill]

Hello Nic,

It seems that I am not getting the workflow property correct. I've tried

jira.permissions.assign.projectrole=Administrators

jira.permissions.assign.projectrole=10002

(the ID for the Administrators role, as suggested through this post - https://community.atlassian.com/t5/Jira-Core-questions/Granting-permissions-to-a-project-role-through-properties/qaq-p/366271)

And I assigned the property to every status in the workflow applicable to the one issue type.

Still a user not in the Administrator role was able to use the Assign To Me link in the Issue Details View to change the assignee on the issue to herself.

[Trudy Claspill]

I got it.

I had "permissions" (plural) rather than "permission" (singular) in the property name.

Fixing that did the trick. The Assign To Me link disappeared for users not in the project Administrator role.