Issues can be viewed via search even without access

[Linda Korpås]

I have a couple of users (external) that should only have access to view one project. Meaning they should not be able to view any other issues in any other project. 

I have managed to configure this by creating a Group for these users which is the only group they are attached to, and avoid giving permissions to "any logged in user" in any other project. I have tested and the result is almost what I want but not perfect.

I have logged in as the external user and I can see: 

1 - If the user look in "View all projects" they can see 3 other projects but doesn't see any issues within the projects. But why are they visible at all in the list and no other projects? These three are Team managed and company managed software projects. I had expected the "View all projects" list to only show the project they have access to. 

2 - If I, when logged in as the external user, use the Search bar in Jira, I can see some issues by Key and Summary (if I start typing some letters that matches a Key for example). They can see the names of the issues but they don't have the access to view the issues. I can't figure out why issues from some projects appear in the search bar when they don't have access to the project ...does anyone know? 

Issues they can see in the search bar are from Team managed projects and Company managed projects. 

Thanks!

[Trudy Claspill]

Hello @Linda Korpås 

Do you have any Company Managed projects where the Browse Projects permission includes Application Access or Public?

Do you have any Team Managed projects where the Access level for the project is Open or Limited?

[Linda Korpås]

Hi @Trudy Claspill 

I have looked through all our permission schemes now and made sure there are no Application access, Public or "Any logged in user" access under Browse projects.

I have found one Team managed project that was set to Open for all users of our Site so I will change that. 

However I can't see anything in our Risk management project (that is a Company managed project) that could grant access for anyone that doesn't have a project role, site admin or participant etc. But still there is a long list of issues from that project shown in the search bar if I start typing R for example. 

But I am now starting to think that when I use the function in Jira that let me log in as another user, maybe the search bar is still linked to my own account/profile? Could that be the case?

Cause the problem isn't that the external user can access projects and issues but can see the titles (Key and summary) of issues in the seach bar. Maybe this is just me that sess this even though I have logged in as another user?

[Tobias H]

(Edit: The article was for read-only access. Sorry 😅)

[Dave Mathijs]

Hi @Linda Korpås welcome to the Atlassian Community!

Has that external user been added to a Role in the team-managed project (under Project access). If yes, to which role: Viewer, Member or Administrator?

[Linda Korpås]

Hi! @Dave Mathijs 

Yes in the team-managed project that the user should have access to he has been given a Member role.

And to clarify some information - He is included in a group specifically created for this purpose and for these external users (I am only testing with one user now to make sure it works ). He also have Software license but is not a member of any other group and the group is not used for any other project.