Jira Read Only access to Database

[Avinash Singh]

Hi,

I would like your thoughts on this. Users are requesting read only access to the jira database in order to some of their reporting. 

I am reluctant to grant this access to users for obvious reasons i.e

1 - Granting read access will not adhere to the permission scheme and projects security.

2- Users could execute long running complex queries that could cause issues with the database.

Thoughts?

Regards,

Avinash

[Nic Brough -Adaptavist-]

Your reluctance is well placed.  There are three big problems, of which you've immediately spotted two.

1.  Performance can be a concern.  If you do end up being forced into this, then do not give direct access.  Set up a replicated copy of the database and let their reporting run off that, so they can't cripple your production machine.

2.  Yes, you're right about security - there is none if you grant them database access.

3.  Jira's database is not built for reporting.  Even the most simple view of an issue is 17 joins and gets vastly worse as soon as you do things like add a component or version will add another set, not just one.  The data structures for search simply are not there.  Your users will need to build and maintain a vastly complicated data dictionary which will need a lot of support and maintenance.

In short.  No. 

Tell them to do their reporting properly, and stop making the totally fallacious "it's a database so I can report on it" assumption.    Get their report definitions off them, and either build the reports in Jira or get a reporting add-on that understands it and hence fixes the problems I've just rambled about.

[Avinash Singh]

Thanks Nic - Exactly what I thought.

I did plan on possibly granting read access to our replicated database, but then I ran into the security consideration again. So i reconsidered.

They want to use Power PI to report, stating that the reports from there are more rich, since they building dashboards for other internal products with it.

[Avinash Singh]

Another consideration with database access is PI data and compliance. 

[Nic Brough -Adaptavist-]

Good point, compliance probably aren't going to like "help yourself to all the data with no security controls or permissions" either.

If you are going to let them use PI, then you would want to check that it has the right data dictionary, one that is secured and compliant (i.e. replicates Jira's browse permission and security level schemes)

[Senthil Nathan]

@Avinash Singh  Finally what was your conclusion? I am looking for similar requirement of building reports in PBI.