Permission Scheme issue

[Phil Borrell]

Hi All, 

I need some help/ideas about fixing a problem I see in my Jira Cloud instance:

We have a project that needs to grant a 3rd party company access to a specific project in our Jira instance. I've created a group for them, provided them with the necessary permissions, and added the group to the project.

Before I sent it live to the externals, I added myself into the group using an external email address so I could test the security. Logged in, and found I can access every project in our Jira instance - this is frustrating!

What i have noticed during my investigation is that all projects in our instance have the Anyone logged in Access permission turned on in the Project share screen.

Is this what is causing the problem or am i missing something?

Before you suggest changing the permissions for the projects stop prevent Anyone logged in to have access, currently, this is not a possibility, all though it has been raised to management.

Is there potentially another solution?

Any suggestions would be greatly appreciated

Phil

[Walter Buggenhout · Accepted solution]

Hi @Phil Borrell,

Your analysis is correct. If you want to grant selected access to specific projects and not to others, there is no other way than removing any logged in user from the browse project permission in your permission schemes.

And obviously that would entail you need to replace that with e.g. a group that holds all your internal users and not the external ones. That is a change, but I don't see why management would have any objections against that.

[Phil Borrell]

@Walter Buggenhout Thanks for confirming my fear, much appreciated.

Management is against it because it's not currently a priority.

But that's up to them!

[Prince Nyeche · Accepted solution]

Hi @Phil Borrell 

Welcome to Community! First of all, its not scalable to use groups in the Permission scheme, the reason being that it becomes a nightmare to manage down the road and the overhead becomes bulky. instead, opt out to using project roles which works better on a per Project basis rather than globally with groups.

Coming back to your question, you've got something going on there. Any logged in user is a terrible idea on any Project. it means that no project can be confidential and any employee within the Organization can see what's happening on other projects even though they are not involved in it. Your management should quickly revoke this Permission and switch to Project roles instead. I see no reason why it is not possible except there's another reason behind such; which to me, I think its not very bright.

What I would suggest is for you to get a report on what your Projects currently looks like, who has access to what project, which groups are assigned to what user and what project role exist in each project in respect to the roles given to the users within the project. That would give you a thorough idea of what's going on and how to remedy the situation. Most probably, you can bring this up to the Management and provide a factual basis why things should change the way you see it. A lot of security issue might arise as a result of poorly managed permission scheme, which if not managed properly is a hassle to the business as a whole.

[Phil Borrell]

@Prince Nyeche 

Thanks for the info, much appreciated.

I won't go into details as to why the company has set Jira up this way, but i have informed them of the dangers of doing this.

Phil