Configuring Issue Level Security

What is an Issue Security Level?

Issue security levels allow you to control who can see individual issues within a project (subject to the project's permissions).

An issue security level is a named collection of users. Issue security levels are created within issue security schemes, which are then associated with projects. Once an issue security scheme has been associated with a project, its security levels can be applied to issues in that project (note, sub-tasks will inherit the security level of their parent issue). Those issues will then only be accessible to members of that security level.

A security level's members may consist of:

Individual users
Groups
Project roles
Issue roles such as 'Reporter', 'Project Lead', and 'Current Assignee'
'Anyone' (eg. to allow anonymous access)
A (multi-)user picker custom field.
A (multi-)group picker custom field. This can either be an actual group picker custom field, or a (multi-)select-list whose values are group names.

Only users with the project-specific 'Set Issue Security' permission can apply a security level to an issue, regardless of whether they are members of the security level.

On this page:

Why use Issue Security?

As an example, a company may have a public instance of JIRA running. Within this instance they may have several projects that external people (customers) can browse. However, it may not be appropriate to show all issues to the customers. To achieve this you could:

Create an issue security scheme.
Create an issue security level named 'Private' for this scheme.
Add appropriate people to the 'Private' security level.
Associate the issue security scheme with the relevant projects.
Set the security level of specific issues to 'Private'.

Creating an Issue Security Scheme

Log in as a user with the 'JIRA Administrators' global permission.
Select 'Administration' > 'Issues' > 'Issue Security Schemes' to open the 'Issue Security Schemes' page, which lists all the Issue Security Schemes currently available in your JIRA installation.
Keyboard shortcut: 'g' + 'g' + start typing 'issue security schemes'
Click the 'Add Issue Security Scheme' button.
Screenshot 1: the 'Issue Security Schemes' page
In the 'Add Issue Security Scheme' form, enter a name for the issue security scheme, and a short description of the scheme. Then click the 'Add' button.
You will return to the 'Issue Security Schemes' page, which now contains the newly added scheme.

Adding a Security Level to an Issue Security Scheme

Log in as a user with the 'JIRA Administrators' global permission.
Select 'Administration' > 'Issues' > 'Issue Security Schemes' to open the 'Issue Security Schemes' page, which lists all the Issue Security Schemes currently available in your JIRA installation.
Keyboard shortcut: 'g' + 'g' + start typing 'issue security schemes'
Click the name of any scheme, or the link 'Security Levels' (in the 'Operations' column), to bring up the 'Edit Issue Security Levels' page.
In the 'Add Security Level' box, enter a name and description for your new security level. Then click 'Add Security Level'.
Screenshot 2: the 'Edit Issue Security Levels' page

Setting the Default Security Level for an Issue Security Scheme

You can choose to specify a Default Security Level for your issue security scheme.

The Default Security Level is used when issues are created. If the reporter of an issue does not have the permission 'Set Issue Security', then the issue's security level will be set to the Default Security Level. If the project's issue security scheme does not have a Default Security Level, then the issue's security level will be set to 'None'. (A security level of 'None' means that anybody can see the issue.)

Log in as a user with the 'JIRA Administrators' global permission.
Select 'Administration' > 'Issues' > 'Issue Security Schemes' to open the 'Issue Security Schemes' page (above), which lists all the Issue Security Schemes currently available in your JIRA installation.
Keyboard shortcut: 'g' + 'g' + start typing 'issue security schemes'
Click the name of any scheme or the link 'Security Levels' to bring up the 'Edit Issue Security Levels' page (above).
- To set the Default Security Level for an issue security scheme, locate the appropriate Security Level and click its 'Default' link (in the 'Operations' column).
- To remove the Default Security Level for an issue security scheme, click the 'Change default security level to "None"' link (near the top of the page).

Adding Users/Groups/Project Roles to a Security Level

Log in as a user with the 'JIRA Administrators' global permission.
Select 'Administration' > 'Issues' > 'Issue Security Schemes' to open the 'Issue Security Schemes' page (above), which lists all the Issue Security Schemes currently available in your JIRA installation.
Keyboard shortcut: 'g' + 'g' + start typing 'issue security schemes'
Click the name of any scheme or the link 'Security Levels' to bring up the 'Edit Issue Security Levels' page (above).
Locate the appropriate Security Level and click its 'Add' link (in the 'Operations' column).
This will display the 'Add Users/Groups/Project Roles to Issue Security Level' page. Select the appropriate user, group or project role, then click the 'Add' button.
Repeat steps 5 and 6 until all appropriate users and/or groups and/or project roles have been added to the security level.
Screenshot 3: the 'Add Users/Groups/Project Roles to Issue Security Level' page

Assigning an Issue Security Scheme to a Project

Log in as a user with the 'JIRA Administrators' global permission.
Click the 'Administration' link at the top of the screen.
Click 'Projects' and select the project of interest. This will display the Project Summary screen (see Defining a Project).
In the 'Permissions' section, click the link that corresponds to the 'Issues' label (this will either be the name of the project's current Issue Security Scheme, or the word 'None').
This will bring up a list of Issue Security Schemes. Select the Issue Security Scheme that you want to associate with this project.
Screenshot 4: the 'Associate Issue Security Scheme to Project - Step 1' page
If there are no previously secured issues (or if the project didn't previously have an issue security scheme), skip the next step.
If there are any previously secured issues, select a new security level to replace each old level. All issues with the security level from the old scheme will now have the security level from the new scheme. You can choose 'None' if you want the security to be removed from all previously secured issues.
Screenshot 5: the 'Associate Issue Security Scheme to Project - Step 2' page
Click the 'Associate' button to associate the project with the issue security scheme.

Deleting an Issue Security Scheme

Log in as a user with the 'JIRA Administrators' global permission.
Select 'Administration' > 'Issues' > 'Issue Security Schemes' to open the 'Issue Security Schemes' page (above), which lists all the Issue Security Schemes currently available in your JIRA installation.
Keyboard shortcut: 'g' + 'g' + start typing 'issue security schemes'
Click the 'Delete' link (in the 'Operations' column) for the scheme that you want to delete.
You cannot delete a Issue Security Scheme if it is associated with a project; you must first unassign the scheme. To unassign a scheme, please refer to Assigning an Issue Security Scheme.
On the confirmation page, click 'Delete' to confirm the deletion. Otherwise, click 'Cancel'.

Copying an Issue Security Scheme

Log in as a user with the 'JIRA Administrators' global permission.
Select 'Administration' > 'Issues' > 'Issue Security Schemes' to open the 'Issue Security Schemes' page (above), which lists all the Issue Security Schemes currently available in your JIRA installation.
Keyboard shortcut: 'g' + 'g' + start typing 'issue security schemes'
Click the 'Copy' link (in the 'Operations' column) for the scheme that you want to copy.
A new scheme will be created with the same security levels and the same users/groups/project roles assigned to them. Your new scheme will be called 'Copy of ...'. You can edit your new scheme to give it a different name if you wish.

Child pages