Show groups which are assigned to project roles

[Former user]

One possible value of the project roles tab is that users could see which group they would need to be a member of to contribute to the project. So a better display would be to use the same display as in the project admin page and let the user select a group to expand it to its members.

[Former user]

Another problem is that the cashed-out groups might give the wrong impression. For example, we have a global admin group, jira-administrators, which is in the admin role of all projects so that the support team can give emergency help. But we don't take over the content of the project admin position - e.g. adding users to roles or groups. If the user sees a flat list consisting of the global support team and the project admins, he might not know who to turn to if he needs helping getting into a project role.

[Holger Schimanski]

Thanks for raising this issue and sharing your ideas on this topic!

To my opinion groups in JIRA is an admin feature - nothing for end users. Only JIRA admins can say who is in which group and can really make use of the groups. That's the reason, why they are not show so far in JIRA Project Role Tab. I don't see much value in it.

Version 1.x was just using projectRoleManager.getProjectRoleActors(tmpProjectRole, tmpProject) to retrieve the users of a role with no change to get the assigned groups.

But since version 2.x I know a little bit more about the process. Using permissionSchemeManager.getEntities(tmpPermissionScheme, "projectrole", new Long(Permissions.BROWSE)) with "group" instead of "projectrole" you could retrieve the assigned groups.

Actually I currently don't have the time to do this. If you want to help, feel free to fork this plugin and create a pull request implementing this feature. Your input is highly welcome!

Kind regards

Holger

P.S. Concerning jira-administrators group, just add the group directly to the permission in permission scheme instead of adding the group to a project role. Then it will not appear in the project role tab.

[Former user]

Hi Holger,

Thanks for the tip about putting the group directly in the permission scheme! This is actually a better solution than what we have been doing and improves the results of your plugin greatly. :)

So we can now use the plugin as is, even without group expansion.

Regarding the handling of groups, it is true that groups are basically the business of the project admin. However, we sync with Active Directory and projects may use AD groups, which are not necessarily managed by the same person as the project admin. In this case, the user could perhaps see a group for his team, realize that he must be missing from this group, look up the group owner in Outlook, and ask him to add him to the group. That being said, if he can at least know who the admin of the project is (which he can't see without your fine plugin), he is already a step farther by himself, and the admin can be expected to understand the groups since he set them up himself.

In conclusion, there is a use case, but not a high priority.

Regards, David

[Paul Jarman]

Hey Holger, I have a large user base, ~ 10k users, who often don't know the Project Admins are. Your plugin provides and excellent way to display this information, however, our jira-admins group members are included in the listing. As the usernames are listed in alphabetical order there isn't an easy way for users to determine who the Project admins are. Without a way to differentiate between users in the Project Admin Role vs users in a group in the Project Admin Role the plugin we cannot use it.

How difficult would it be to add a setting which allowed or prevented the automatic expansion of Jira User Groups in a Project Role?

Thank you for your time.

Sincerely, Paul D. Jarman

[Holger Schimanski]

Hi Paul!

Could you check to directly add jira-admins group to Administer Project permission in permission scheme instead of adding jira-admins to Project Admins role? If you assign Administer Project not via project role but directly in the permission scheme the jira-admins group members are not listed in the Project Role tab. This should solve the problem you described above.

Cheers, Holger

[MattS]

I agree with Paul. When I tell people to contact their project admins and show them the Project Roles tab they see the project admins all mixed in with users from the jira-administrators group. I don't mind how the difference is shown but it would be very helpful. I prefer to add groups to roles rather than permission schemes directly for more admin flexibility (that's why roles were originally created) but it is one workaround I suppose.

[Holger Schimanski]

Actually I think, that JIRA Admins doesn't have a project role. They are admins supporting the project in config issues.

So, sematically I think it is good not to assign jira-administrator to a project group. Directly assign jira-administrator to Permission scheme instead of via project role is a good choice I think.

Another work around could be to create a project role "JIRA Administrators" and assign this role to Browse Projects and Administer Projects permission. Then it is more obvious to user of the project role tab, that these people are not really involved in the project, but support the project as JIRA administrators.

How about that?

Cheers, Holger

[MattS]

I see both sides. Sometimes I add jira-administrators to the permission scheme to stop project admins from removing it from the Administrators role. But then you may need to have permission schemes with jira-admins and without. But now I'm reconsidering whether the default JIRA setting. Maybe, just maybe, the Administrators role should always be empty by default and then specific users added.

[Paul Jarman]

Hi Holger, I had to remove your plugin as many of our Projects place the jira-users Group into the Users Role. This means thousands of users show up in the Users Role. Is it possible to restrict what Roles are show? I know you don't want to display Group names which are expandable, so an admin option for the Plugin which restricts Groups from being shown at all for each Role would at least solve my management chain's complaint. Thank you for your time.

Sincerely, Paul

[Holger Schimanski]

You can remove jira-users from project role Users and directly assign jira-users to Browse Project permission in the permission scheme.

Then they are still able to access the project, but not assigned to Users role and therefore not shown in the tab.

Does that help?

[David Sedlock]

This only helps if jira-users is always in the Users role. If there are exceptions, it is no solution. -David

[Holger Schimanski]

You can have two permission schemes. One where jira-users is assigned, one where it is not.

[Radek Janata]

Hi @hski, what's the current status about Roles add-on dev and particularly this request. In our company, we maintain user roles mainly via groups that are connected to LDAP/AD groups. So, if a user knows what groups are defined in project roles, he/she can easily request membership in the involved AD group.

So showing groups in roles is really a good benefit that saves JIRA administrator's time.

[Holger Schimanski]

Your comment makes perfectly sense. But sorry, I don't have concrete plans to implement this, because I have to focus on other things at the moment. But if it is very important for you, you could talk to your internal developers and contribute to the plugin via branch / merge / pull request.

[Holger Schimanski]

I am currently implementing this feature so that it is also shown, if users were assigned to a role via a group.

Here is a preview of what is shown.

This will be released as version 2.4.0 of the JIRA project Role Tab.

Best regards, Holger

[Cameron Eldridge]

Hi @hski ,

Would your team consider making the groups collapsed by default and expandable when needed? Or, consider providing some other administrative controls that allow us to choose which project roles should display individual users. We have thousands of users in our instance (JIRA Software v7.2.8 Data Center), which causes the Roles tab to load very slowly for projects that include the jira-users group in the Users project role. This specific performance issue is why we chose not to implement this plugin in our production environment.

Best, Cameron

[Holger Schimanski]

The problem with very large groups has been reported also by some other users and I am currently working on it. See #19 for details and status.

In some situations there is a useful workaround. Instead of assigning the Jira group to a project role which has assigned to certain permissions in the permission scheme (e.g. jira-users is assigned to a project role Users, which is assigned to "Browse projects" and "Add comments" permission), you could also directly assign the Jira group to the required permission (e.g. assign jira-users to "Browse projects" and "Add comments") in the permission scheme assigned to the project.

Hope this helps. Otherwise wait for #19 to be released, which will be available before end of the year.

[Cameron Eldridge]

Hi @hski ,

Thanks for the update! We do leverage the permission scheme in many cases, but we can't always prevent project administrators from adding the jira-users group to a role. I'm glad to see a fix implemented so quickly.

Best, Cameron

[Holger Schimanski]

Hope everything works fine with the new release. Feel free to leave a arting and comment at Atlassian Marketplace for Jira Project Role Tab plugin. :-)

Best regards, Holger