List of all groups and where they are used

[Neha Pande]

Need A way to extract all groups and there usage through SQL 

[Rinaldi James Michael]

Deleted my older comments. Sharing a comparatively better solution now.

SELECT
DISTINCT(group_name) as "Jira Group Name",
CASE
WHEN TABLE1."Group" = group_name THEN 'Used'
ELSE '-'
END AS "Projects Roles",
CASE
WHEN TABLE2."Group" = group_name THEN 'Used'
ELSE '-'
END AS "Global Permissions",
CASE
WHEN TABLE3."Group(s)" = group_name THEN 'Used'
ELSE '-'
END AS "Custom Fields",
CASE
WHEN TABLE4."Group" = group_name THEN 'Used'
ELSE '-'
END AS "Shared Dashboards",
CASE
WHEN TABLE5."Group" = group_name THEN 'Used'
ELSE '-'
END AS "Shared Filters",
CASE
WHEN TABLE6."Group" = group_name THEN 'Used'
ELSE '-'
END AS "Filter Subscriptions",
CASE
WHEN TABLE7."Group" = group_name THEN 'Used'
ELSE '-'
END AS "Board Administrators",
CASE
WHEN TABLE8."Group" = group_name THEN 'Used'
ELSE '-'
END AS "Application Access",
CASE
WHEN TABLE9.groupname = group_name THEN 'Used'
ELSE '-'
END AS "Permission Scheme",
CASE
WHEN TABLE10.groupname = group_name THEN 'Used'
ELSE '-'
END AS "Permission Scheme Granted to Group",
CASE
WHEN TABLE11.actionlevel = group_name THEN 'Used'
ELSE '-'
END AS "Comment Visibility",
CASE
WHEN TABLE12.sec_parameter = group_name THEN 'Used'
ELSE '-'
END AS "Issue security level",
CASE
WHEN TABLE13.grouplevel = group_name THEN 'Used'
ELSE '-'
END AS "Work Log visibility",
CASE
WHEN TABLE14."JQL" LIKE CONCAT('%',group_name,'%') THEN 'Used'
ELSE '-'
END AS "Saved Filters (JQL)",
CASE
WHEN TABLE15."VALUE" LIKE CONCAT('%',group_name,'%') THEN 'Used'
ELSE '-'
END AS "Automation Rules",
CASE
WHEN TABLE16."Descriptor" LIKE CONCAT('%',group_name,'%') THEN 'Used'
ELSE '-'
END AS "Workflows"


FROM cwd_group cg





LEFT JOIN
(
SELECT
DISTINCT(pra.roletypeparameter) AS "Group"
FROM
projectroleactor pra
LEFT JOIN projectrole pr ON pra.projectroleid = pr.id
LEFT JOIN project p ON pra.pid = p.id
WHERE
pra.roletype = 'atlassian-group-role-actor'
)
as TABLE1 ON TABLE1."Group" = cg.group_name






LEFT JOIN
(
SELECT
DISTINCT(gp.group_id) AS "Group"
FROM
globalpermissionentry gp
)
as TABLE2 ON TABLE2."Group" = cg.group_name







LEFT JOIN
(
SELECT
DISTINCT(cfv.stringvalue) AS "Group(s)"
FROM
customfieldvalue cfv
LEFT JOIN customfield cf ON cf.id = cfv.customfield
LEFT JOIN jiraissue ji ON cfv.issue = ji.id
LEFT JOIN project p ON ji.project = p.id
WHERE
cf.customfieldtypekey IN (
'com.atlassian.jira.plugin.system.customfieldtypes:grouppicker',
'com.atlassian.jira.plugin.system.customfieldtypes:multigrouppicker'
)
)
as TABLE3 ON TABLE3."Group(s)" = cg.group_name









LEFT JOIN
(
SELECT
DISTINCT(shp.param1) AS "Group"
FROM
sharepermissions shp
LEFT JOIN portalpage pp ON shp.entityid = pp.id
WHERE
shp.entitytype = 'PortalPage'
AND shp.sharetype = 'group'
)
as TABLE4 ON TABLE4."Group" = cg.group_name






LEFT JOIN
(
SELECT
DISTINCT(shp.param1) AS "Group"
FROM
sharepermissions shp
LEFT JOIN searchrequest sr ON shp.entityid = sr.id
WHERE
shp.entitytype = 'SearchRequest'
AND shp.sharetype = 'group'
)
as TABLE5 ON TABLE5."Group" = cg.group_name










LEFT JOIN
(
SELECT
DISTINCT(fs.groupname) AS "Group"
FROM
filtersubscription fs
LEFT JOIN searchrequest sr ON fs.filter_i_d = sr.id
)
AS TABLE6 ON TABLE6."Group" = cg.group_name






LEFT JOIN
(
SELECT
DISTINCT(ba."KEY") AS "Group"
FROM
"AO_60DB71_BOARDADMINS" ba
LEFT JOIN "AO_60DB71_RAPIDVIEW" rv ON ba."RAPID_VIEW_ID" = rv."ID"
WHERE
ba."TYPE" = 'GROUP'
)
AS TABLE7 ON TABLE7."Group" = cg.group_name





LEFT JOIN
(
SELECT
DISTINCT(group_id) AS "Group"
FROM
licenserolesgroup
)
AS TABLE8 ON TABLE8."Group" = cg.group_name





LEFT JOIN
(
SELECT
DISTINCT(SP.perm_parameter) AS GroupName
FROM
schemepermissions SP
INNER JOIN
permissionscheme PS ON SP.scheme = PS.id
WHERE
SP.perm_type = 'group'
)
AS TABLE9 ON TABLE9.groupname = cg.group_name





LEFT JOIN
(
SELECT
DISTINCT(SP.perm_parameter) AS GroupName
FROM
schemepermissions SP
INNER JOIN
permissionscheme PS ON SP.scheme = PS.id
WHERE
SP.perm_type = 'group'
)
AS TABLE10 ON TABLE10.groupname = cg.group_name






LEFT JOIN
(
select DISTINCT(ja.actionlevel)
from jiraaction ja
)
AS TABLE11 ON TABLE11.actionlevel = cg.group_name







LEFT JOIN
(
select DISTINCT(sec_parameter)
from schemeissuesecurities sis
where sis.sec_type = 'group'
)
AS TABLE12 ON TABLE12.sec_parameter = cg.group_name




LEFT JOIN
(
select DISTINCT(wl.grouplevel)
from worklog wl
) AS TABLE13 ON TABLE13.grouplevel = cg.group_name





LEFT JOIN
(
SELECT
DISTINCT(reqcontent) AS "JQL"
FROM
searchrequest
) AS TABLE14 ON TABLE14."JQL" LIKE CONCAT('%',cg.group_name,'%')





LEFT JOIN
(
select "VALUE" from "AO_589059_RULE_CFG_COMPONENT"
) AS TABLE15 ON TABLE15."VALUE" LIKE CONCAT('%',cg.group_name,'%')




LEFT JOIN
(
SELECT
jw.descriptor AS "Descriptor"
FROM
jiraworkflows jw
) AS TABLE16 ON TABLE16."Descriptor" LIKE CONCAT('%',cg.group_name,'%')

[Matt Doar]

A manual way is to look at all your permission schemes and notifications schemes for the groups they use. Then go through all project roles and do the same. Groups can also be used for sharing of filters and dashboards. Finally check all workflows for group usage in the XML. Very tedious!

I would love to see a plugin that does all this for admins

[Neha Pande]

Hello Matt I want an SQL query for that since my admins want to automate the process

[Matt Doar]

Me too!

[Nic Brough -Adaptavist-]

And fields, and the configuration of dashboard gadgets, and use in saved filters, and, and, and...

[Rinaldi James Michael]

(COMMENT DELETED)

[Rinaldi James Michael]

(COMMENT DELETED)

[Benjamin Horst]

Hello @Rinaldi James Michael , thanks a lot for sharing your work. The scripts saved me a lot of our time.

[Rinaldi James Michael]

(COMMENT DELETED)

[Nic Brough -Adaptavist-]

Do these scripts cover all the aspects listed before?

[Benjamin Horst]

@Nic Brough -Adaptavist- -Adaptavist- : for Jira it covered the following aspects:  Project Roles, Global Permissions, Custom Fields. Shared Dashboards, Shared Filters, Filter Subscriptions, Application Access, Saved Filters (JQL), Notification Schemes, Permissions Scheme, Permission Scheme granted to group, Comment visibility, Issue security level and Work log visibility. That was well enough for the preparation of our migration.

[Benjamin Horst]

@Rinaldi James Michael : there's a few things, that @Andree Knoche improved in the final Jira group script to make that script work for us: 

• Line 34 (the type "String" was wrong)

 HashMap<String, HashSet<String>> groupHashMap = new HashMap<>();

• Line 49 (we are using an Oracle DB, which dodn't work with the contact of three parameters. Don't know if the original line works for other DBs, though)

CONCAT (CONCAT(p.pkey, '-'), ji.issuenum)

• Line 99: a try/catch to get the error messages and some logging. 

[Rinaldi James Michael]

(COMMENT DELETED)

[Benjamin Horst]

It's only the Line 49 that is different, since we use Oracle DB. Oracle users just have to switch the CONCAT to what Andree added and your script works smoothly.

I am no Groovy Expert, but in my eyes Line 34 should not be working in any setup, since you initialize it with "String": 

 HashMap<String, String> groupHashMap = new HashMap<>();

 But then add a new HashSet<String>:

groupHashMap.put(allGroupsInJira[g],new HashSet<String>());

[Rinaldi James Michael]

o

[Alexander Grimstad]

This article comes on the top of google queries for "jira find where group is used", and does sadly not contain the answer from other similar questions. 

So I'm therefore pointing out that there is a knowledge-base article for it: https://confluence.atlassian.com/jirakb/how-to-identify-group-usage-in-jira-441221524.html

[Nic Brough -Adaptavist-]

Problem is that article doesn't reference the complexities or how to actually answer the question.  That's why Google lands here - it explains it properly.

[Alexander Grimstad]

Your answer explains the complexity on the details and nuances in the question -- I wholeheartedly agree.

The kb-article gave me the answer I needed, based on a very similar question to this community post, nevertheless :) 

[Todd Lair]

I usually never comment on forums but can attest that this post is worthless and I don't understand why the question is so hard. All I want to see is the all the permission schemes (and potentially others schemes like notifications) that have a reference to the group in question. Inside the JIRA admin all you see is that the group in question has no product access which is flat garbage because the users access the product every day and are on multiple permission schemes. My use case might be far less complex than ones above, but maybe simplicity is a good place to begin?

[David Innes]

We are looking at permissions of the current groups to see if all are necessary and that the permissions aren't being duplicated over multiple groups.

That a number of the groups have only the comment "This group currently has no product access" is not helpful.  

We have the cloud version which doesn't allow for running SQL against the Database.

So any development which would allow clear showing of what permissions each group has would be very welcome.

Kind Regards

[Nic Brough -Adaptavist-]

The question is hard to answer because it does not have any context.  So the answers you're seeing here are either highly generic (because there's no context) or trying to ask for that context.

I think it's probably important to be very clear about the context of the question.  What problem are you trying to solve?  (In fact, is it really a problem?  "I want to cut down the number of groups" is not the actual problem, the problem behind that is likely more to be "the admin is struggling to maintain all the people in the groups".  Getting a list of permissioned groups probably isn't going to help much with that, it would be far better to review the groups without looking at permissions, get the groups tidied into what you actually need from them, get the space admins to review their spaces to see that the new/changed groups have the right access, and then kill off the ones you don't need later.  Or, even, stop using groups apart from the bare minumum of "can use the application" and maybe a small handful of wide-ranging standard groups, and get the space admins to add the people they need when they need them.

A list of 100,000 lines listing every permission every user and every group in every space is not really going to help you rationalise, the permissions aren't really the problem you're trying to solve in these cases.

[Johnny Hermann]

As a Jira Admin,
I want to see all permitted access a particular group of users has,
So that I can ensure they do not have more access than I intend.

Jira OOTB is not very secure-by-default once you let in users outside your org.  You need to lock down various things - conveniently via groups.

For example, group "external-users-client1" should have permission to see only a Jira project dedicated for collaborating with Client1.

I want to be able to address concerns like:  Did I set that up properly, or possibly create a huge security hole that is not obvious?

[Nic Brough -Adaptavist-]

I'd suggest asking your admins for a more human answer.

I can think of around 30 different SQL queries that, while "accurate", won't tell you what you really need to know about access.

Instead of giving you a "Microsoft" answer (technically accurate, but completely useless), could you tell us what you are trying to do?  What question are you trying to answer, and why?

[Neha Pande]

Hi Nic, 

I am currently an Intern and trying my hands in every Area of JIRA, I tried my hands in JIRA, EasyBI, BigPicture, so My JIRA admin gave me a assignment to figure out where all the groups are getting used in JIRA for Ex.

1. Permission schemes
2. Any other shares:

• Filters
• Dashboards
• Agile Boards
• Tempo
• eazyBI

I want to extract the list. 

I found this link but I have to insert all the roles and run separate query for for each which kind of make it complicated.

https://confluence.atlassian.com/jirakb/how-to-identify-group-usage-in-jira-441221524.html

Need some work around for this.

[Nic Brough -Adaptavist-]

Right, that's a significant project in itself, even in a small Jira.

Your list is a start, but you also need to look at

• Fields
• Filters referring to fields (of many types)
• Notifications
• Subscriptions
• Workflows (conditions, validators, post functions, triggers)
• Integrations (application links for example)
• Outgoing calls
• And
• And
• And

As you can tell, this is not a simple task.  However, it is generally of limited use too, and hence pretty much a massive waste of time.

Go back to the real question. "I want to know where groups/users are used" is not the real question.  Why do you want to know where they're used?  What's the point?  Why does it matter?

[Neha Pande]

The JIRA admin wants it for tracking process and she wants to automate the process instead of looking into JIRA manually

[Nic Brough -Adaptavist-]

Automate what?

[Neha Pande]

I mean the process of looking all the Usage of the groups she wants it in excel tabular format

[Nic Brough -Adaptavist-]

I'm afraid that's a circular answer - "Why do you want to know where they are used?" is not answered by "I want to look at where they are used".

Could you tell us why this matters and how it would be more useful than going into the configuration to check, understand and amend access?

[Neha Pande]

as I mentioned I am an intern and this is assignment given to me by JIRA admin. I suppose may be want to present the report to management or to save time. I am not sure why they want it that way.

[Nic Brough -Adaptavist-]

Then ask them.

Take this conversation to them.  Point out that "where a group is used" is a very complex thing to try to extract from Jira (even before you install any add-ons).

It is still possible, but it's going to take you a LOT longer to form SQL than it is to investigate every place where they might be used manually, and than any investigation is going to take a very very long time.

If you knew why you were doing this, you would probably save a lot of time because you could focus on the actual question.

[Michael Aglas]

a use case could be that a group (coming from AD) will be deleted and you want to replace it with another one... so it would be good to know in advance and replace it before it will be deleted, especially when you have a big Jira and propably a high impact on this

[Nic Brough -Adaptavist-]

In that case, you'll want to be work through all the UI options anyway, because you'll be needing to change the settings for the new group.  A long list of where it might have to change is not going to help you.