limit users to selected Clients in a Project

[Sue Bridges]

We have a current Support Project that we log issues against.

I want some Users to be able to log in and to only create, edit and view Issues from only certain Clients within this Project.  Others will have complete access to all Clients as now.

To test, I have set a User with a new User Group and given that Group limited actions on issues e.g. Create, Edit, Resolve. 

I have created a new Issue Security Scheme and a 'general users' level in it.  This level is for the Group and a custom field (Client).  It lets me select the Custom field but no limiting values within it, so I'm not sure on that bit how a User is to be limited to certain information.

In Projects I set the Issue Security for the limited Users - not sure if this is the correct thing to do.

So I log in with my new User and I can only see the one correct Project to log issues against.  I Create, but of course I can select all Clients...

I need to hide Clients that this User should not see.  How do I do that?

Also, by setting the Projects Issue Security, what about my regular Users?

Thank you in advance.

[Andy Heinzer · Accepted solution]

Hi Sue,

If I understand your concerns here, you are wanting to limit certain users to only see issues created for/by a select set clients.  It sounds like you might have achieved part of this through the use of the issue level security, but that you have an additional problem here because users can still see values in that client field that you want to restrict from them.

The Issue level security is a useful means to restrict the issues themselves from a subset of users in the project apart from the actual permission schemes, but issue level security won't be able to provide you the ability to hide potential field values from issues in that project.

Instead I think what you want here is also what I think of as being called field level security.  There was an old feature request for this back in JRASERVER-1330.  Ultimately it was something that was decided not to be implemented in Jira natively.  As such, at least natively in Jira, there is not a way for you to let some users see some possible values of the field itself.  

However that request did note that there are some plugins for Jira that might be able to help here, such as Secure Fields for Jira for one example, or Field Security Plugin for JIRA.   It is also possible there are other solutions in https://marketplace.atlassian.com that might be helpful here.

I hope this helps.

Andy

[Sue Bridges]

Hi Andy,

Yes, it's field level security that I need.  Disappointed that JIRA can't do this by itself, but I will have a look at the Apps.

Many thanks

Sue