How to give administrator rights to normal user via plugin?

[JIRA Plugin Developer]

Hello,

I would like to give admin rights to every user that uses my plugin. Is this possible? And if yes how can I do that?

[Radu Dumitriu · Accepted solution]

JiraAuthenticationContext jac; // ... get it from injection or something
ApplicationUser userBefore = jac.getUser(); //current user
ApplicationUser wannabeUser = // ... admin, if you want
jac.setLoggedInUser(wannabeUser);
try {
  //... do sensitive stuff here
} finally {
  jac.setLoggedInUser(userBefore);
}

[Radu Dumitriu]

In short, I find your solution (to offer admin rights each time) a bit cumbersome.

[JIRA Plugin Developer]

Thanks for your code sample.

One more question:

How do you initialize the wannabeUser, so that this user is an admin user? Can I do that in my plugin? Can I do that overall without being an administrator myself?

Can you please give a code sample of the Initialization?

[Radu Dumitriu]

UserManager umgr; // again, inject

ApplicationUser wannabeUser = umgr.getUserByKey("admin"); //well, put it in some config

Happy ?

[JIRA Plugin Developer]

We will see ...

[JIRA Plugin Developer]

@Radu Dumitriu

Maybe I had deliver you with more background info.

My plugin should be integrated later in a running Jira System from my Company. I definitly get no admin rights.

As I can see, you get an admin-user by key as shown in your code sample above. Can I somehow create an admin-user via my Plugin because there are many methods in the Jira API restricted to admin?

Or must someone (with admin rights) from my Company allow me to create an admin dummy user first?

[Radu Dumitriu]

In the code I gave you *assume* the identity of a well-known user. It's the principle that matters here. The rest is linked to your internal policies.

I sincerely do not understand why you need to create an user (refer to the JIRA api for that matter).

[JIRA Plugin Developer]

Please give some more advices:

- To create a dummy admin user, I again need to be administrator, or how can I do that?

[Nic Brough -Adaptavist-]

Well, your plugin could add them to the administrators group, but I'd strongly recommend not doing this (as all of my Jira jobs in the last 9 years have started with "please clean up the mess made by having too many admins")

Could you explain what you are actually trying to achieve in this plugin? I really don't think you mean you want to give users admin rights, I suspect you're just trying to do something normally restricted to an admin?

[JIRA Plugin Developer]

Yes, your're right. I want to update the owner of a filter. Therefore I need to be administrator.

updateFilterOwner(JiraServiceContext serviceCtx, ApplicationUser user, SearchRequest request)

Persists a SearchRequest to the database - only available to administrators.

My plugin should change the fixVersion in a filter's query. And in order to change the filter you must be the owner. But everybody using the plugin should be able to change the filter. So I have to develop a workaround.

So my approach:

When normal user wants to update:

1. add user to administrator's group
2. updateFilterOwner (Owner is User now)
3. update the filter
4. updateFilterOwner (Owner is old Owner again)
5. remove user from administrator's group

Would this be possible, or are there better approches?

[Nic Brough -Adaptavist-]

That won't work - you need admin rights to update the admin group.

Updating the owner of a filter by any old user is probably not a good idea - if I've written a load of filters and used them in dashboards and reports, then I don't want other people arbitrarily taking my filters away and possibly breaking them for me.

The API has ways to override security if you're coding in a plugin, but it's been a while since I used them, and I can't remember them.

A quick cheat might be to have a dummy admin user and use that instead of the current user (although that chews up a licence seat, and is hard-coding so it's a bit ugly)

[JIRA Plugin Developer]

Please give some more advices:

- To create a dummy admin user, I again need to be administrator, or how can I do that?

[Nic Brough -Adaptavist-]

Sorry, I don't understand? To add an admin user, you add a user and add it to the admin group.