Security Schemes and Users seeing issues they should not be able to

[Nawaaz SOHAWON]

Hi,

So my issue is that software projects and service desk users can see all my projects at the moment.

The steps I have undertaken to try and resolve this issue:

• Create a new group for Project A
• Create a new Permission scheme with no permissions at the moment (even the one concerning Browse Projects)
• Add he new group to the new permission scheme
• Link the new permission scheme to Project A
• Log in as one of the users in the group

Result: user can still see all projects.

However I can see that the 'jira-servicedesk-users' group is automatically assigned to the user if they have the 'Service Desk' application access and this causes the default permission scheme to be assigned to the user.

In a nutshell, my question is how do we restrict users of Project A to only see Project A when they log in?

Thanks for your consideration,

Nawaaz

[Nic Brough -Adaptavist- · Accepted solution]

Jira does not restrict, it only grants permissions at the project level (issue security is a different story).

In theory, this is really simple, because all you have to do is set the permissions so that "users matching a rule can see the issue".  That grants permission.  It is often by saying something simple like "users in the role of 'user' in the project can see it", and then putting the users (or groups) you want into that role in the project.  If you do not want to let a user into a project, then do not add them to a set that lets them in.

But.

Jira ships with some terrible defaults which automatically grant access to anyone with a login.  Before you can use the simple, sane and reasonably intuitive rule above, you have to unpick these dreadful defaults, removing all the stuff that grants automatic access.

There's a good guide to it over at https://community.atlassian.com/t5/Jira-questions/JIRA-Software-project-permission-restrict-user-access-to-one/qaq-p/779572