Documentation for JIRA 4.1. Documentation for other versions of JIRA is available too.

Skip to end of metadata
Go to start of metadata

Issue security levels allow you to control who can see individual issues within a project (subject to the project's permissions).

An issue security level is a named collection of users. Issue security levels are created within issue security schemes, which are then associated with projects. Once an issue security scheme has been associated with a project, its security levels can be applied to issues in that project (note, sub-tasks will inherit the security level of their parent issue). Those issues will then only be accessible to members of that security level.

A security level's members may consist of:

  • Individual users
  • Groups
  • Project roles
  • Issue roles such as 'Reporter', 'Project Lead', and 'Current Assignee'
  • 'Anyone' (eg. to allow anonymous access)
  • A (multi-)user picker custom field.
  • A (multi-)group picker custom field. This can either be an actual group picker custom field, or a (multi-)select-list whose values are group names.
Icon

Only users with the project-specific 'Set Issue Security' permission can apply a security level to an issue, regardless of whether they are members of the security level.

On this page:

Why use issue security?

As an example, a company may have a public instance of JIRA running. Within this instance they may have several projects that external people (customers) can browse. However, it may not be appropriate to show all issues to the customers. To achieve this you could:

  • Create an issue security scheme.
  • Create an issue security level named 'Private' for this scheme.
  • Add appropriate people to the 'Private' security level.
  • Associate the issue security scheme with the relevant projects.
  • Set the security level of specific issues to 'Private'.

Creating an Issue Security Scheme

  1. Log in as a user with the 'JIRA Administrators' global permission.
  2. Bring up the administration page by clicking either the 'Administration' link on the top bar or the title of the Administration box on the dashboard.
  3. On the panel on the left, under the title 'Schemes', click the link labelled 'Issue Security Schemes'.
  4. This will display the 'Issue Security Schemes' page. This page lists all of the Issue Security Schemes that JIRA currently has. Click the 'Add Issue Security Scheme' link.
  5. In the 'Add Issue Security Scheme' form, enter a name for the issue security scheme, and a short description of the scheme. Then click the 'Add' button.
  6. You will return to the 'Issue Security Schemes' page, which now contains the newly added scheme.

Adding a Security Level to an Issue Security Scheme

  1. Log in as a user with the 'JIRA Administrators' global permission.
  2. Bring up the administration page by clicking either the 'Administration' link on the top bar or the title of the Administration box on the dashboard.
  3. On the panel on the left, under the title 'Schemes', click the link labelled 'Issue Security Schemes'.
  4. This will display the 'Issue Security Schemes' page. This page lists all of the Issue Security Schemes that JIRA currently has.
  5. Click the name of any scheme or the link 'Security Levels' to bring up the 'Edit Issue Security Levels' page.
  6. In the 'Add Security Level' box, enter a name and description for your new security level. Then click the button 'Add Security Level'.

Setting the Default Security Level for an Issue Security Scheme

You can choose to specify a Default Security Level for your issue security scheme.

The Default Security Level is used when issues are created. If the reporter of an issue does not have the permission 'Set Issue Security', then the issue's security level will be set to the Default Security Level. If the project's issue security scheme does not have a Default Security Level, then the issue's security level will be set to 'None'. (A security level of 'None' means that anybody can see the issue.)

  1. Log in as a user with the 'JIRA Administrators' global permission.
  2. Bring up the administration page by clicking either the 'Administration' link on the top bar or the title of the Administration box on the dashboard.
  3. On the panel on the left, under the title 'Schemes', click the link labelled 'Issue Security Schemes'.
  4. This will display the 'Issue Security Schemes' page. This page lists all of the Issue Security Schemes that JIRA currently has.
  5. Click the name of any scheme or the link 'Security Levels' to bring up the 'Edit Issue Security Levels' page.
  6. The default issue security level for a scheme can be set and removed, as follows:
    • To set the Default Security Level for an issue security scheme, locate the appropriate Security Level and click its 'Default' link.
    • To remove the Default Security Level for an issue security scheme, click the 'Change default security level to "None"' link.

Adding Users/Groups/Project Roles to a Security Level

  1. Go to the 'Edit Issue Security Levels' page (see above).
  2. Locate the appropriate Security Level and click its 'Add' link:
  3. This will display the 'Add Issue Security' page. Select the appropriate user, group or project role, then click the 'Add' button.
  4. Repeat steps 2 and 3 until all appropriate users and/or groups and/or project roles have been added to the security level.

Assigning an Issue Security Scheme to a Project

  1. Log in as a user with the 'JIRA Administrators' global permission.
  2. Bring up the administration page by clicking either the 'Administration' link on the top bar or the title of the Administration box on the dashboard.
  3. A list of projects is displayed
  4. Select the project you want by clicking on the project name. This will display the project details
  5. Click the 'Select' link beside the 'Issue Security Scheme' caption.
  6. This will bring up a list of Issue Security Schemes. Select the Issue Security Scheme that you want to associate with this project.
  7. If there are no previously secured issues (or if the project didn't previously have an issue security scheme), skip the next step.
  8. If there are any previously secured issues, select a new security level to replace each old level. All issues with the security level from the old scheme will now have the security level from the new scheme. You can choose 'None' if you want the security to be removed from all previously secured issues.
  9. Click the 'Associate' button to associate the project with the issue security scheme.

Deleting an Issue Security Scheme

  1. Log in as a user with the 'JIRA Administrators' global permission.
  2. Bring up the administration page by clicking either the 'Administration' link on the top bar or the title of the Administration box on the dashboard.
  3. On the panel on the left, under the title 'Schemes', click on the link labelled 'Issue Security Schemes'.
  4. This will display the 'Issue Security Schemes' page. This page lists all of the Issue Security Schemes that JIRA currently has. Click the 'Delete' link for the scheme that you want to delete.
    Icon

    You cannot delete a Issue Security Scheme if it is associated with a project; you must first unassign the scheme. To unassign a scheme, please refer to Assigning an Issue Security Scheme.

  5. A confirmation screen will appear. To delete, click 'Delete'; otherwise click 'Cancel'.

Copying an Issue Security Scheme

  1. Log in as a user with the 'JIRA Administrators' global permission.
  2. Bring up the administration page by clicking either the 'Administration' link on the top bar or the title of the Administration box on the dashboard.
  3. On the panel on the left, under the title 'Schemes', click the link labelled 'Issue Security Schemes'.
  4. This will display the 'Issue Security Schemes' page. This page lists all of the Issue Security Schemes that JIRA currently has. Click the 'Copy' link for the scheme that you want to copy.
  5. A new scheme will be created with the same security levels and the same users/groups/project roles assigned to them.

Additional Resources

  • Issue security scheme overview tutorial video — Watch this short tutorial video to see how to use an issue security scheme to restrict the viewing of issues to specified users. Please note the JIRA version and JIRA edition of the tutorial video before watching.