Issue Details (XML | Word | Printable)

Key: JRA-6381
Type: New Feature New Feature
Status: Open Open
Priority: Major Major
Assignee: Unassigned
Reporter: Jeff Turner [Atlassian]
Votes: 295
Watchers: 159
Operations

Add/Edit UI Mockup to this issue
If you were logged in you would be able to see more operations.
JIRA

Permissions per workflow step / state

Created: 10/Apr/05 10:07 PM   Updated: Thursday 06:13 AM
Component/s: Permissions Security, Workflow
Affects Version/s: None
Fix Version/s: None

Time Tracking:
Not Specified

Issue Links:
Duplicate
 
Reference
 

Participants: Andrew Perepelytsya, BM, Dale Fraser, Darren Bell, David Soul [Atlassian], Gilles Bernaerts, Greg Heap, Inger Henning, Jakob, Jeff Putsch, Jeff Turner [Atlassian], jira@atlassian.com, John Allen, Kalle Hallivuori, Leena Romppainen, Martin Lopušek [CFH], Michael Kryzhanovsky, Monika Joshi, nick jansen, Nikolay Gorbunov, Ray Oei [Furore], Sebastian Thies, Susan Hauth, Tal Abramson, William Halverson, Wiro van Schaik and Zacharias J. Beckman
Since last comment: 10 weeks, 2 days ago
Labels:
Support reference count: 25


 Description  « Hide
In many situations it would be useful if permissions could vary based on the state an issue is in. The most obvious example is making Closed issues non-editable. Ideally any permission (edit, delete, link, assign etc) should be variable by step, and for some, by transition (eg. assignees).

 All   Comments   Work Log   Change History      Sort Order: Ascending order - Click to sort in descending order
Ray Oei [Furore] added a comment - 20/Oct/05 03:18 AM
The current permission scheme is not flexible enough. For instance: someone should be able to reopen an issue but not resolve it (Q&A department for instance).
See also JRA-5783.

Jakob added a comment - 21/Dec/05 03:25 AM
Under workflow, transition, it is possible to define who is allowed to do this transactions by adding a condition to the transition. Would it also be possible to define the team that can be assigned to this issue in the new state.

Jeff Turner [Atlassian] added a comment - 01/Mar/06 05:47 PM
It will be possible to restrict permissions per workflow step in 3.6, by adding 'properties' to workflow steps. Eg. by setting 'jira.permission.editable.group' to 'jira-developers' in the 'Resolved' step, only jira-developers will be able to edit resolved issues. It will also be possible for parent issues to restrict permissions on their subtasks

There won't be a pretty interface for setting permissions per step in 3.6, so I'd hesitate to call this feature 'done' just yet.


Leena Romppainen added a comment - 02/May/06 06:21 AM
Adding a note here just in case: Current workflow based plugin has a bug that disables sub-task editing. For more info, see http://jira.atlassian.com/browse/JRA-10057

Wiro van Schaik added a comment - 15/May/06 10:28 AM
I would like to enforce that only the person that has created an issue or the projectadministrator is able to close an issue. I can't think of a way how to do this now in Jira (we have 3.6.1 Enterprise) and it seems that an implementation of this issue would possible enable this so my vote is in.

Wiro van Schaik added a comment - 15/May/06 10:44 AM
Oops, I just found out that my request was actually a duplicate of JRA-4050 and thus is possible in the Enterprise version so please disregard my previous comment.

Jeff Turner [Atlassian] added a comment - 24/May/06 01:19 AM
FWIW, the status on this is as follows.

We did some work to allow this in 3.6. About halfway we realised this introduces a whole extra layer of complexity to bulk operations, particularly bulk move, which we wouldn't have time to address in the 3.6 timeframe. I can't say when we'll get to this again, but since a fair bit of work has been done already it shouldn't be in the too distant future.


Kalle Hallivuori added a comment - 31/Aug/06 06:25 AM
Hi.

I'd like to further encourage finishing this work on finer permission control.

It appears that this is an issue that probably blocks us from upgrading, as we are dependent of the workflow permissions plugin long as this remains incomplete, and bulk operations are also in use.

Power to you. Keep up the great quality and reliability.

Cheers,

Kalle Hallivuori / Sulake IT Support


Ray Oei [Furore] added a comment - 09/Feb/07 01:48 AM
A lot of votes...
I know you guys are very busy and there are other pressing issues but any status update on this {big} one?

John Allen added a comment - 27/Mar/07 11:16 AM
nudge nudge.

Darren Bell added a comment - 18/Jul/07 05:08 AM
^^ bump ^^ Any news guys?

Andrew Perepelytsya added a comment - 18/Jul/07 09:15 AM
Darren, JIRA Suite utilities/extension pack provides this functionality among others, you may want to have a look. We have configured more complex workflows with permissions for http://mule.mulesource.org/jira

jira@atlassian.com added a comment - 18/Jul/07 09:26 AM
Abwesenheitsnotiz:

Vielen Dank für Ihre Mitteilung.

Momentan bin ich abwesend.

Ich bin ab 23.07.2007 wieder für Sie da. Ihre Mail wird nicht automatisch weitergeleitet.

Falls Ihr Anliegen vorher Aufmerksamkeit erfordert, wenden Sie sich bitte an +41 41 727 2131 oder support@systransis.ch

Notice of absence:

Thank very much you for your inquiry.

At the moment I am away from my desk and my e-mail.

I will be back on 23 Julz 2007. Your e-mail will NOT be forwarded automatically.

Should you need to contact someone before this date, please call +41 41 727 2131 or send a message to support@systransis.ch


Nikolay Gorbunov added a comment - 17/Aug/07 07:01 AM
Hi folks,

We're using 3.8, the issue still persists. Did I get it right that there are some plugins that solve the problem?


Nikolay Gorbunov added a comment - 13/Sep/07 08:56 AM
Ping ping ping.

Allowing an issue to get assigned to a member of different group than one which should be responsible for handling the issue in a given state can result in losing the issue which's really bad.

E.g. if I transition the issue to "To Be Documented" but assign it to Peter which's a QA guy (say, by mistake), the issue will likely get lost because Peter knows he never gets issues in "To Be Documented" and may have filters saved which prevent him from seeing those.

Email notifications on "Issue Assigned" event partly help, yet they don't give a warranty unless Peter is 0% lazy and has less than 200% workload.


Tal Abramson added a comment - 06/Feb/08 09:22 AM - edited
Guys , any news regarding this one?
i am facing a customer who wishes the reporter to be able to do assign only once
so i have a customized workflow with a "assign" screen
but if the reporter does not have the assign permission , he don't see the Assignee field
but if he has the assign permission , he will always have the operation Assign , arrrrrrr

any workaround ?


Monika Joshi added a comment - 06/Feb/08 09:26 AM
my new corp id is monika.joshi@corp.aol.com , Pls send all your mails to my new corp id

Sebastian Thies added a comment - 06/Feb/08 09:53 AM
Hi Tal,
you could add a custom user picker to your assign screen and use Phil Herbst's Assign From Custom Field Plugin (http://confluence.atlassian.com/display/JIRAEXT/Assign+From+Customfield+Plugin) in your workflow. Then the reporter does not need the assign pemission.

Tal Abramson added a comment - 07/Feb/08 01:13 AM
Sebastian you rock
thanks a lot , i'll use it

Inger Henning added a comment - 19/Feb/08 09:29 AM
I'd be very interested in setting up a situation where you cannot comment on a closed issue!

Jeff Putsch added a comment - 04/Apr/08 11:06 AM
We would very much like to restrict the ability to comment based on workflow state.

Jeff.


Zacharias J. Beckman added a comment - 10/Jun/08 09:24 AM
Yes! This would be perfect. We want to be able to change permissions on issues based on issue type, and this would work for that. For instance, Change Orders are very restrictive and can only be modified by a small subset of the development team.

Dale Fraser added a comment - 15/Jul/08 11:46 PM
I can't believe you can't do this. I have just setup a complex workflow only to find that there is no control over the permissions.

I also cant believe that this feature has been sitting in a queue for 3 years.


Michael Kryzhanovsky added a comment - 15/Oct/08 05:55 PM
Really needed. In a big company with many users it would be really a help to limit the users to certain group on each step.

Greg Heap added a comment - 09/Dec/08 10:40 PM
Is there any news on this one?

BM added a comment - 29/Dec/08 09:39 AM
We are interested in this as well. The permissions would open a whole new market segment for JIRA as a solid workflow solution. However, without the permissioning it doesn't cut it for workflows.

jira@atlassian.com added a comment - 29/Dec/08 09:42 AM
Lieber Mail-Sender

Bis zum 05.01.2008 weile ich ausser Hause und werde keine Email lesen.
Ihre Email wird nicht automatisch weitergeleitet.

Mit freundlichem Gruss und besten Wuenschen fuers Neue Jahr

Erwin Achermann


William Halverson added a comment - 29/Dec/08 10:40 AM
We brought JIRA into our developement group for issue/bug tracking, but it escaped: the CIO wants it to be our ITS-wide issue tracking system. Unfortunately, without workflow based permissions I don't think I'll be able to met our needs.

Susan Hauth added a comment - 20/Jan/09 09:11 AM
We are just implementing JIRA for the first time, and was very disappointed not to be able to restrict the assignability to users on the Workflow. This is a much needed feature.

Gilles Bernaerts added a comment - 20/Jan/09 10:02 AM
The following page contains some piece of info that might actually help some of you guys out.

Basically you can add extra restrictions on transitions and steps of your workflows by adding extra properties to them.

A couple of examples:

  • jira.permission.assignable.group=QA
    • means that only members of the QA group will be assignable in this particular state.
  • jira.permission.comment=denied
    • means that commenting is denied in this particular state.

Susan Hauth added a comment - 20/Jan/09 10:41 AM
Gilles,

I tried defining the assignable group in the properties of the
Transition and it didn't do any sort of restriction. The full list of
users continues to come up in the "assign" field. I tried every step of
the workflow. Am I doing something wrong?

Thanks........Susan


Gilles Bernaerts added a comment - 20/Jan/09 10:58 AM
Susan,

The jira.permission.* and jira.issue.editable properties only work on workflow steps and not on transitions.

Hope this helps.


Susan Hauth added a comment - 20/Jan/09 01:59 PM
Thanks!!! Got it to work....

Where is the list of "properties" that you can define in JIRA? These
are great.

Susan


David Soul [Atlassian] added a comment - 07/Apr/09 12:34 AM
PARTIAL WORKAROUND: Do you need users without edit rights to have some ability to reassign issues? Try the User Picker From Project Role plugin to be able to reassign based on a custom field for groups.

Martin Lopušek [CFH] added a comment - 07/Apr/09 02:37 AM
I think two things are important to write to this workaround before jira-administrators will start using this plugin and changing their workflows:

1. plugin is for version 3.12 of jira.

2. this plugin is not officialy supported - noone will guarantee this plugin will work properly with other versions of jira

3. actually one bug is reported in this plugin - it's a minor bug, only huge WARN logs are generating.


nick jansen added a comment - 23/Apr/09 01:44 PM
We realy need this function to prefent customers from commenting on closed issues. Is there some workarround for this?