Purpose

Consider the following scenario:

In Crowd, all the users and groups are located within a single directory. As a result, when JIRA is connected to this directory with read-write permission enabled, JIRA Administrators will be able to add users to any groups.

In some cases, the same directory could be shared among different applications, and JIRA Administrators should be not allowed to be able to make any changes to certain groups.

Solution

Due to the limitation with Crowd directory, it is not possible to restrict it to read-only on per group basis. The workaround is to setup multiple directories with different levels of permission, and separate the groups into the directories.

In Crowd:

1. Create a directory with read-only permission
2. Create a directory with read-write permission
3. Create an application and associate it with the read-only directory
4. Create another application and associate it with the read-write directory
5. Groups that need to be restricted should be located in the read-only directory only
6. Other groups will be located in the read-write directory

In JIRA:

1. Connect to both the directories
2. JIRA Administrators will not be able to modify any groups in the read-only directory even if they change the crowd permission in JIRA to read-write