Is there an Autorisation Scheme management more efficient than the others?

[PINTEUR Clément]

Hello,

We are looking forward to simplify the way we manage our autorisation settings.

In that matter, we would like to know if there is any preferred autorisation settings from a performance point of view (we have a 500 users licence).

Our current use is : put our users into differents groups. Assign those groups to Project Roles. Then, attribute those Project Roles to Project Persmission into an Autorisation Scheme.

• Pros :
  • Admin have full control
  • Have a unique Autorisation Scheme
• Cons : 
  
  • Project leaders don't have the visibility on the users whom can see the project
  • Trend to create a group for each project
  • Admin needs to maintain all the groups regulary in order to match the reality

Ex: 

roles_actuels.jpg

We recently checked the following page from the Atlassian documentation : https://confluence.atlassian.com/display/JIRA062/Migrating+User+Groups+to+Project+Roles

In that case, a user assignment to a specific project is not managed directly by the system administrator but by the project leader.

• Pros :
  
  • Let the project leader decide on whether or not a user can access the project
  • Project attribution is more precise
  • Ease the maintenance for JIRA Admin
• Cons :
  
  • A little messy when a large number of JIRA users is assign to a Role

Ex: 

roles_recommande.jpg

As asked above, can you confirm that the last solution does not impact performances?

Thanks,

Regards,

Clément PINTEUR

DARTY

[SanaS · Accepted solution]

In terms of performance, the second solution is fine; at a large retail client I had 200+ projects and inherited that structure, which worked fine. Every instance is different, but what is useful to look at is how people are working in JIRA and the groups they are working with. Are they always working with the same people in the same groups, or is each man on his own, working in 5-10 projects, all different from the person beside him? If that's the case, the second setup could be better. From an admin perspective though, I'd have the first solution as the default.