Issue Details (XML | Word | Printable)

Key: JRA-5869
Type: New Feature New Feature
Status: Open Open
Priority: Major Major
Assignee: Unassigned
Reporter: Andreas Deimer
Votes: 45
Watchers: 25
Operations

Add/Edit UI Mockup to this issue
If you were logged in you would be able to see more operations.
JIRA

Sub-Task should have independent security levels

Created: 08/Feb/05 03:30 AM   Updated: 18/Nov/08 09:16 PM
Component/s: Permissions Security
Affects Version/s: 3.0.3
Fix Version/s: None

Time Tracking:
Not Specified

Issue Links:
Duplicate
 
Reference
 

Participants: Ahmad Masrieh, Andreas Deimer, Anton Mazkovoi [Atlassian], Bettina Zucker, Brian Nguyen [OLD], Edmond, John Arnold, Martin Marusinec, Matt Kenigson, Michael Sutter, Nick Menere [Atlassian], Ray Oei [Furore], rowan berry and Steve Clark
Since last comment: 5 weeks, 2 days ago
Support reference count: 6
Labels:


 Description  « Hide
When creating a sub-task, it automatically inherits the security
level of its parent. Using the workaround described in JRA-5442,
it is possible to change the security level of the sub-task, e.g.
to hide special tasks from your customers.

However, it is not possible to set the ("hidden") security level
upon creation of the sub-task. So, if you want to create a
private sub-task, that is not accessible by your customers, you have
to first create a sub-task that is automatically private, hence
generating an automatic eMail notification of your customer. Then,
you have to edit the sub-task to change the security level.

Wouldn't it be more efficient to let the user choose the security level
when creating the sub-task?
Or could we have special security levels for different types of sub-tasks.
E.g. create a sub-task "private sub-task" that automatically relates to
a certain security level "private".

(Just to explain: We are using Jira Enterprise 3.0.3 to track new
features. It is used by us and our clients. When a new feature issue is
created, we put several development/private sub-tasks under it, to
split work for one feature or to assign private work that has to
be done in order to build the new feature. But we do not want our
customer to see, what is going on "behind the scenes".)



 All   Comments   Work Log   Change History      Sort Order: Ascending order - Click to sort in descending order
Anton Mazkovoi [Atlassian] added a comment - 15/Feb/05 04:01 PM
The main problem we had with being able to see the parent issue but not all of the sub-tasks is displaying the progress bar for it. It is also possible to configure workflow such that it is not possible to resolve an issue while ther are unresolved sub-tasks. If the user cannot see the sub-tasks then it might be confusing why the issue cannot be resolved.

I see your use case, however. Thanks for reporting this.


Steve Clark added a comment - 07/Apr/05 01:37 PM
If you roll in JIRA-5863 (Task sub-task time tracking), then I think the progress bar issue goes away: The parent task estimates and logged hours will reflect those of the subtasks, and so the progress bar won't look strange.

As far as the business of not being able to resolve a task with invisible unresolved subtasks, this seems like an obscure corner case that shouldn't stand in the way: If I'm not allowed to see the subtasks, is it really reasonable for me to think about resolving the parent task? If this odd situation occurs, I'd just say tough luck - you can't resolve the parent, and you can't find out very much about why not.


Ahmad Masrieh added a comment - 15/Nov/05 08:26 AM
Anton wrote:

The main problem [....] displaying the progress bar for it.

Keep it simple: keep the progress bar, remove the list with sub-task and add the following messages

  • "x of y sub-tasks still unresolved / not closed"
  • "you need the have the appropriate security level to browse the list"

Anton wrote:

If the user cannot see the sub-tasks then it might be confusing why the issue cannot be resolved.

It might be confusing without any information, but if you keep the progress bar and add the messages everything will be fine.

I strongly agree to Andreas to this feature request.

It would help to separate high-level feature request from technical details.

Check

  • JRA-7835 - Option to remove sub-tasks from roadmap / changelog
  • JRA-8522 - Option to remove / hide sub-tasks from Release Notes

And it seems that there not too much code change to enable this feature - check JRA-5442 and check back with Mark..


Anton Mazkovoi [Atlassian] added a comment - 16/Nov/05 02:15 AM
Thanks for your feedback! Its great to see suggestions coming from our users. Otherwise it is very difficult to ensure that we build features the way our customers want them.

I should also have mentioned that the progress bar and workflow are not the only things that stand in out way. The main problem is deciding which features we should implement first. We have a lot of feature requests and choosing which ones to implement next is the most challenging part of our jobs. The way we make choices is described here:
http://confluence.atlassian.com/display/DEV/Implementation+of+New+Features+and+Improvements

Thanks again for the feedback, it is very useful for us.

Anton


Ahmad Masrieh added a comment - 16/Nov/05 06:29 AM
Please review this post

and consider this issue as a part of a greater whole.

Ahmad


Bettina Zucker added a comment - 06/Feb/06 09:14 AM
Hello,
I have Jira 3.3.3 and need to assign some subtasks to an external software supplier who should not be allowed to see the whole task.
I tried to the workaround described in JRA-5442, but for Jira 3.3.3 I could not find the named file.
Is there a workaround to be able to edit the subtask security level?

Cheers

Bettina Zucker


Brian Nguyen [OLD] added a comment - 07/Feb/06 12:55 AM
Hi Bettina,

Apologies if this confused you but the scenario where sub-tasks became public while the parent issue was private is essentially a bug. The workaround was used to overcome this and ensure that the security level was at least settable.

In 3.1 and later, sub-tasks inherit whatever security level the parent issue has. From this issue of course this course of action is a topic of discussion. Suffice to say, the workaround in JRA-5112 is no longer valid.

Instead is it possible for you to create a linked issue that the external supplier can see?

Thanks,
Brian


Bettina Zucker added a comment - 07/Feb/06 06:51 AM
Hello Brian,

thanks for the clarification.
To ensure the SW supplier could see the subtask now we downgraded the complete task to the supplier's security level.
This did not work though.
The subtask's security level is now shown as "internal" in the issue navigator column, but it is shown as "supplier" in the issue's detail page.
This is just the inconsistency in the appearance.
We asked the supplier if he can access the issue, and he could not.
Now we are retrying by removing the subtask and creating it again.
This seems to work, at least the inconsistency between navigation and detail view is made away.

So I have a problem now,
but I have found a solution to the problem of Mr Daimer!

Just declare the issue first "private", create the subtasks, which will be also "private", and then downgrade the issue to "public"
and then create all "public" subtasks.
Well this is not a seriuos solution, since it is relying on a bug and poses too many constraints on issue entry timing.

Regards Bettina Zucker


Brian Nguyen [OLD] added a comment - 07/Feb/06 09:20 PM
Hi Bettina,

Thanks for the feedback. In relation to the problem with your security level, I would say that the problem was with the index.

For future reference, when you see a discrepancy between the issue navigator and the issue itself, the best thing to do is reindex.

Thanks,
Brian


rowan berry added a comment - 16/Mar/06 10:33 PM
Hi,

I would actually really find this feature useful (Sub-task issue security levels). We have a number of external customers that log issues for different projects, and when the support person responsible for owning the issue needs to get some developers from different areas they create assign subcases for each to do the work.

The trouble is that we don't want the customer being able to see our internal development processes, they should ideally just be dealing with the support person.

Shall vote for this issue.

Cheers,

Rowan.


Matt Kenigson added a comment - 10/Apr/06 03:29 PM
This would indeed be very useful. We're working around it by avoiding subtasks at the moment but with JRA-5617 and JRA-5410 just around the corner we're thinking about this more and more.

Ahmad Masrieh added a comment - 02/Jun/06 01:33 PM
Unfortunately I appended by mistake a '_' character to the URL – this leads to a dead link

And because of JRA-1100, I'm not able to correct all posts with the wrong URL

Please review using the corrected link: http://forums.atlassian.com/thread.jspa?threadID=9146

Ahmad


Edmond added a comment - 15/Aug/06 04:22 PM
Our team would like to manage a single Project which can be shared by developers and external customers. To do this, we would like to create the required sub-tasks necessary to complete the customers requested feature/bug fix without sharing the information. Cloning the orignal issue, applying security to it, and then creating sub-tasks in the cloned issue is not a clean approach and requires extra work. I see this request as a new feature has not been assigned Fix Version yet. Are there any other suggestions as a work around in the meantime?

Voted for this one.

Regards.
Edmond


Nick Menere [Atlassian] added a comment - 15/Aug/06 09:10 PM
Edmond,

No real workarounds at the moment. I have seen some customers use linking to fulfil this need, it is not as nice but it does work and the issues can have independent issue securities.

We don't like to set a fix for until we know for certain what version it will be going in and we only usually commit to the next release.

Cheers,
Nick


Michael Sutter added a comment - 09/May/07 01:45 AM
We've also got the urgent need that subtasks have a different security-level than the task they belong to and producing duplicates with linking really isn't an option. Let me give you a bigger picture of this: We'd like to use JIRA, so that our customers can make requests and follow their status. The problem is that we cannot train our customers in the use of JIRA, so they'll probably report bugs, request features, etc. all in just one request. Internally, we'll split up the original request and open the appropriate subtasks, like bug, enhancement, improvement, separate offer, etc., but don't want our customers to be able to see the subtasks.

Martin Marusinec added a comment - 21/Jan/08 04:44 AM
I will welcome too, if this functionality works.

Ray Oei [Furore] added a comment - 22/Sep/08 06:36 AM
My vote is in.
It is already an old request, any indication on an possible ATA??

John Arnold added a comment - 27/Oct/08 04:00 AM
I would really welcome this functionality as well. The "bulk changing" of issue security level will also need to be changed to provide an option to enable or prevent the cascading of security level to subtasks.