Trying to configure permissions for an HR workflow

[Ben Radlinski]

I've created a project for our HR department to log HR related issues. Due to obvious confidentiality issues, I'm attempting to lock it down, but still make it functional. 

The project has its own permission scheme.

I originally had the HR group and the Admin group in the "Browse Projects" section. Users were still able to create HR issues, but did not receive notifications despite having "reporter" in every section of the notification scheme.

I added our company group to "Browse Projects" and as expected, everyone can see the issues and thus, I can't deploy the project like that. Is there any way to do this in JIRA?

"This" being: a project that allows users to create and comment on their own issue, but not see any other issues in the project?

Thanks.

[Puján Z]

Hi Ben,

I'm looking for companies using Jira for their HR processes to use it as reference to pitch Jira at our company for HR. If your company is 100+ (employees) and doesn't want to stay anonymous, would you please send me the name? Much appreciated! You can send it to x :) Best, pj

[Abdullah Bamuhrez]

Hi, 

To check why notification is not working for an issue reporter, Use the notification helper in the System Panel (Need to login as Jira Admin). 

You can check there why the notification is not sent to an issue reporter.

[Ben Radlinski]

I am unable to use the helper because the ticket number does not appear in the list of available options.

[Abdullah Bamuhrez]

Hi,

We have been doing this for several projects on our Jira V 7.3.4 using only permissions scheme. 

Set the permissions as follow: 

1. Project browse access to: HR Users group, Reporter, Assignee and Watchers.
2. Create issue permission to:  HR Group and Application access (Jira Software)
3. Assignable permission to: HR Group and Application access (Jira Software)
4. Assign Issues permission to: HR Group and Reporter 
5. Edit Issues to: HR Group: Reporter and Current Assignee 

You can create a role for HR Group for the project and assign the permissions to the role instead of the group which is a better practice. You can figure other permissions based on the above sample. It follows similar pattern.

I hope this help you.

[Ben Radlinski]

I tried this configuration, and unfortunately I'm still getting the same result. The new ticket is not created when a user emails the hrhelp email address. Thank you for the suggestion. 

[Abdullah Bamuhrez]

Hi Ben,

Is creating Issue using Jira screen work for you with the correct access right (Reporters will see only their issues)?

If you are using email to create issue then you have to setup the email handler :

https://confluence.atlassian.com/adminjiraserver071/creating-issues-and-comments-from-email-802592933.html

[Ben Radlinski]

Creating issues works, yes. I already have a mail handler, and I can see the issue being created in the server logs. However, I am unable to see it in the project.

[Abdullah Bamuhrez]

Then, could be Issue Security is set for the Issue and you don't have the right to access it. Check what Security Level is defined for the project and add yourself to all of them. 

[Ben Radlinski]

Thank you both, these were very helpful. I will let you know how things go.

[mschonarthatlassian]

Hello Ben,

If I understood correctly, you want only a few groups to have access to browse the projects and users outside of those groups should only be able to see the issues they create and thus are reporters of. Based on that request, I think that you need to set up an Issue Security Level Scheme. That way, you can set a default value for issues and specify which users/groups/Project Roles can see them. To configure a Issue-Level Security Scheme be sure that you have the “Set Level Security” permission.

Go into Settings> Issues> Issue Security Schemes. There, add a security scheme, click on Security Levels and type in the name you want. After that, click Add on the level you’ve just created and select Reporter. Repeat this process to add all the groups you want. Likewise, click on Default to make that level default for every issue. You can check further information about this topic on our Configuring Issue Level Security documentation.

If you do not wish that users can select “None” as the security level, you also need to make the field required by going to Your Project> Settings> Fields, searching for Security Level and then clicking on Required. Or you can Hide the field to make it not visible on the screen. Please be aware that if there are more projects using this field configuration scheme this change will apply to all of them.

I hope that was helpful for you. Please, let me know if I can help you with anything else.

[Prashant Mali]

issue security level is the best option to handle this kind of situation.

Thanks,

Prashant

[Gabriel Senna]

Hi Ben,

There is a way to configure it, that it's using issue security.

You can use Issue Security, to set different levels of security, based on users.

This way, only the reporter of the issue will be able to access the issue.

I'm sending you the below documentation, to check if this can help you and in case you need further help, you can return to me.

https://confluence.atlassian.com/adminjiracloud/configuring-issue-level-security-776636711.html

[Ben Radlinski]

I have everything configured as recommended in the doc above. I created 2 security levels, one for the HR group and one for the users. How do I assign the security to issues? Is there any way to auto assign the security level the same way for every ticket or does the reporter need to assign the security?

[Ben Radlinski]

Does issues security work with email generated tickets? It appears that issues created by email are not showing up in the project.

After a test, it appears the issue is created, but it does not appear in the Project:

"2018-03-20 15:37:18,731 INFO [Human Resources] Caesium-1-4 anonymous Human Resources Human Resources[10700]: Issue HR-20 created"