Using one filter on a dashboard, showing different results for different users?

[Juul Weijers]

Hi, we're trying to leverage dashboards to show reports for different users. In this case, we've created a filter that shows all issues in 5 different project. Theres one user per project that should see these issues, but ONLY for the projects they have access to. That way, we can create one dynamic dashboard that serves 5 different users.

The query is 

project in (ABG, OTHJSM, GHO, LOZSD, OTWJSM) AND resolution = Empty order by created DESC

However, the "Filter Results Gadget" shows no results when logged in as one of those users.

We have enabled a user group for both the filters and the dashboard. 

So, the use case is as follows:

User A has access to Project ABG. User A also has access to the Dashboard, and the filter mentioned above. On this dashboard, a Pie Chart gadget shows what Agents are assigned to the most issues. This works fine. The same filter shows no results when the Filter Results gadget is used. 

What am I missing here?

[Jack Brickey · Accepted solution]

To be clear is the question "why a user cannot see results for a gadget on a dashboard?"?

assuming so can you please verify that this user has access to the filter by going to the filter and clicking on details and inspecting the share.

[Juul Weijers]

Hi Jack, i'll try to make it more clear:

User is member of this group: 

This group has access to the dashboard:

This group also has access to the specific filters i'm using in three "Filter Results" gadgets

Yet, when I log in as this user, I get no results, as per the image i shared above. My OWN results are exactly correct:

[Juul Weijers]

[Nic Brough -Adaptavist- · Accepted solution]

You've gone over most of the permissions in detail there, but there's one missing - can these users actually see any of the issues they should be seeing in the gadget?  (I know you've said "in the project", but that doesn't necessarily mean they can see the issues)

[Juul Weijers]

Hi Nic, what permissions would that be? Would the Browse Project permission suffice, or another permission?

[Juul Weijers]

For instance, the user can see one out of five projects in this filter, yet the filter returns 0 issues, despite there being ~1000 issues in this project the user has permission for.

[Nic Brough -Adaptavist-]

It may be more complex than permissions, but there's a quick test - from the issues that you can see, pick one that your other user should be able to see in the gadget and get them to look at it in the issue view.  If they can see it, then it's not permissions or security.

But your last screenshot answers it.  The gadget is failing because the filter behind it is not valid.

This is rather a torturous one to work out and explain, but I think Jira is reading your JQL in two different ways.

I think someone has added a field called "project" in a team-managed project, and Jira is reading the query differently for different people because some of you can see that project and others can not.

The query for people who can not see the project is working fine, because "project in X, Y, Z" is reading the list of Jira projects.  (Permissions don't matter here - if someone can't see project X, it doesn't break the query, just means it won't return any issues in project X)

But for people who can see that project, "Project in X, Y, Z" means "read the local field", and that field does not have options for X and Y, as you see in your screenshot.

There's a quick test for this - go to the issue navigator and run a search.  Doesn't matter what it is; we're not looking at issues.  Now go to the "columns" button and type "project" into the search.  There will be more than one if I'm right.

TLDR: solution - rename the "project" field in the project that is breaking it.

[Jack Brickey]

excellent sleuth work Nic.

@Juul Weijers , my apologies for being absent and not responding earlier. My time has been taken by other matters unfortunately.

[Nic Brough -Adaptavist-]

I am not sure it's what Juul has run into, but I can replicate it!

It also works correctly if you create a global field called project (for CMPs).  The JQL seems to be picking the first "project" field it finds in the order:

• Project in a TMP
• Actual Project
• Project as a CMP custom field

I still say it's a howling bug in Jira, since it was introduced in version 3-ish - older versions refused to let you create fields with duplicate names!  That needs to come back.

[Jack Brickey]

That is a really odd scenario and I don't think I would've stumbled upon it. Certainly as we have seen in the past, creating custom fields using the same name default system fields will result in bad things. I'm anxious to see what the final culprit is here if not this.

[Nic Brough -Adaptavist-]

Same here, I'd love to know what the root cause is!

[Juul Weijers]

Hi, thanks for your input on this so far. I have checked your suggestions, and here's what I have found so far:

• We don't currently use any TMPs
  • No TMPs in the archive or recycling bin either
  • only used TMP once, over two years ago, as a test case
• There are no other "projects" fields active
• Following @Nic Brough -Adaptavist-  suggestion to check the columns, returns only 1 "project" field, which is filled with the Project Name
• Permissions do check out, as when logging in as the user I can find the proper issues without difficulty
• Filter does work correctly when logged into my admin account:
  • 

If you have any other insights, they will be greatly appreciated, you have been most helpful and critical so far!

[Jack Brickey]

Hi @Juul Weijers , I may have missed it but did you follow the test that Nic suggested. The results would be interesting to understand.

from the issues that you can see, pick one that your other user should be able to see in the gadget and get them to look at it in the issue view.  If they can see it, then it's not permissions or security.

[Nic Brough -Adaptavist-]

Oh.  Bother.  I want to ask if you're sure there are no TMPs, but your screenshot of the project selection in the issue navigator is the most important thing - it rules out my "two fields called project" theory.

I would like to see the result of the permission test on a single issue.

The next test I'd like to do is to get two people (one for which it works, and one for which it fails) to try the same JQL in the issue search.  The JQL you show us in the screenshot starting with "project in (10108, ".  Twice.

Test 1: copy and paste the JQL into the search.  Do they both get the same response (not the issues, just the warning/errors or a successful search)?

Test 2: Start typing the JQL into the search.  Do they both get the warning "10108 is not a valid entry for the project field"?

[Juul Weijers]

Hi Nic, as for your first question:

"I would like to see the result of the permission test on a single issue."

I have logged in as the same user as before. Under Projects, I can see the project containing al JSM issues this user should be able to see. Opening the project, I can see the screenshot below, and opening any issue shows the proper issue views: 

So the issue permissions are not the problem in this case. 

Continuing with your next suggestions:

"Test 1: copy and paste the JQL into the search.  Do they both get the same response (not the issues, just the warning/errors or a successful search)?" 

I have tried your suggestion on my admin account and on the same user account as before, and I get the following results. The top half of this image (marked 1.) is the view I get as an admin. JQL query is valid, and returns ~280 issues. The bottom half (marked 2.) is the user view, which returns a valid JQL query but also returns no issues. The text translates roughly to "The value '[Project Key]' does not exist for field 'Project'"

And, as per your last suggestion, I have tried to just type the JQL query out - which shows a red X as the user can't locate the projects I'm trying to include in the query:

"Test 2: Start typing the JQL into the search.  Do they both get the warning "10108 is not a valid entry for the project field"?" 

And, for fun, I have also tried to find the projectcodes - which returns a valid JQL but again 0 issues as the value "Does not exist for the Project field": 

I feel like we're homing in to the root cause - the pieces are there but I just gotta connect the puzzle. Thanks for your input so far!

[Jack Brickey]

Thanks for the updates her @Juul Weijers ! I'm certainly a bit perplexed here. However, I go back to your original post about wanting to have a single query that works for all users. In this query you list out all five projects. However, not all users have access to all projects. So I am wondering if there is a limitation (?) which results in the JQL failing if a given user does not have access to all projects. 

@Nic Brough -Adaptavist- , i've never tried this myself. Can you confirm or reject my theory? I have not attempted that this myself. 

[Nic Brough -Adaptavist-]

I was barking up the wrong tree earlier.  I've just tried testing this properly.

Yes, you will get the "does not exist for" message from the JQL if a user cannot see the project.

[Jack Brickey]

That makes sense. So the answer is that Juul will need different filters for his dashboards.

[Juul Weijers]

Hi guys,

in a last Hail Mary attempt I have "split" the JQL-filter into its component phrases with a lot of <OR>. To no avail, since it still doesn't work, but I suppose its good to experiment - See block quote below. 

So, to conclude, in order to fulfill the business requirement I have to create more than one dashboard, and create more filters, and create more IdP access groups. Bummer. I'm going to try to work around that...

Block:

(project = ABG AND type = "[System] Service request" AND resolution = Empty) OR (project = OTHJSM AND type = "[System] Service request" AND resolution = Empty) OR (project = GHO AND type = "[System] Service request" AND resolution = Empty AND resolution = Empty) OR (project = LOZSD AND type = "[System] Service request" AND resolution = Empty AND resolution = Empty) OR (project = OTWJSM AND type = "[System] Service request" AND resolution = Empty AND resolution = Empty)