Is it possible to allow ALL users to view an issue except for a group based on a custom field

[Sha Aquino]

I am trying to restrict the view of GroupM on tickets within the project based on the value of custom field 'Client'.

Conditions:

If Client is not ABC, ticket can be viewed by anyone including GroupM users

If Client is ABC, All users except GroupM are able to view the ticket.

--------------------

I was able to configure Issue Security successfully before similar to this but its the other way around - if Client is ABC, only GroupM can view the ticket. If Client is not ABC, anyone can view the ticket. 

I am trying to find out if there is a way for me to reconfigure the issue security scheme I have setup to use except GroupM instead of only GroupM when the Client is ABC.

Thanks in advance for any help :)

[Nic Brough -Adaptavist- · Accepted solution]

No, there's no way to do this.  Permissions in Jira are completely permissive, not exclusive.

[Sha Aquino]

I thought so.. I was just hoping maybe :) Thanks Nic!

[Sha Aquino]

Hi @Nic Brough -Adaptavist- and @Rilwan Ahmed

Just an update on this one. I ended up just using the default Issue security setup. Took a while to complete but meets my client's requirements.

I added all users except the restricted ones into GroupA then added the post function that sets the security level 'GroupAOnly' in ticket if it is for Client ABC. The restricted users then can only view tickets that are not for Client ABC.

[Rilwan Ahmed]

Hi @Sha Aquino ,

There is no direct way to achieve this. But manually you can do my making use of Issue Security schemes.

i.e.

1. Create Security schemes where you add all groups except GroupM
2. When a ticket with  client ABC is created, edit and add security scheme created in step 1 to the ticket.
   This will rat access to all users except GroupM to the particular ticket.

[Nic Brough -Adaptavist-]

That's still the same problem.

Let's say you've got several groups of people, all of whom have "browse project"

Security schemes let you say "only group X can see this issue when security level is set to Y".

But Sha A wants to be able to say "Group X can NOT see the issue when security level is set to Y".

With both permissions and security levels, the only way you can do that is to say "groups A, B, C, D ...... W, Y and Z can see it" - leaving X off the list.  This gives you the problem that if you add a new group who should be able to see the issues, then you have to amend the scheme every time!

[Sha Aquino]

Hi @Rilwan Ahmed 

Thanks for the suggestion. I think it would be possible if we only have a few users/ groups. The project is open to all who has access to jira and we have around 50+ groups.

I agree with @Nic Brough -Adaptavist- as it may be a very tedious process to maintain just for 1 project. 

Thank you though 🙂

[Rilwan Ahmed]

Hi @Sha Aquino 

One more turnaround if your project uses project roles in the permission schemes rather than groups directly, then 

1. Create a new project role, add Group M to it in the project. 
2. Add created role in your permission scheme like what you have for other roles. 
3. Create first security scheme and include newly added project role and existing project roles. 
4. Create Second security scheme with only old project roles and make it default.  So any ticket by default will have second security scheme and for Client ABC, you can edit ticket to first security scheme.

[Sha Aquino]

Hi @Rilwan Ahmed

I think you might have something here. I’ll look into this and try it. I may need to add some adjustments and make use of project roles in the permission schemes since it does not use it. 

Thank you! I’ll post updates on what I get after testing. 🙂