How Security Levels Affect Notifications

Issue Security levels only apply to Jira Users. Non-Jira Users on the issue will still receive Non-Jira Notifications

Change in 3.3.40

In v3.3.40+ we made a change so that when issue events are processed by JEMH the ‘Issue Security’ of an issue is now checked when notifying recipients.

If an issue has a security level set on it, JEMH checks all potential recipients of notifications and filters out anyone who does not have that security level. This is what Jira does so we wanted JEMH to have the same behaviour.

The only difference between JEMH and Jira involves the ‘Browse Issues/Browse Projects’ setting. See below for more info:

 

Jira Notifications

Browse Projects Permission

Issue Security Level

Notification Sent ?

Browse Projects Permission

Issue Security Level

Notification Sent ?

For a native Jira notification to be sent, the user must have BOTH the Browse Projects permission and the correct Issue Security Level. Without both of these the notification is not sent.

Jira notification example

With a new Service Management project, here is the default Jira notification path showing how Issue Security and the Browse Projects permission affects the notifications a user receives.

User ‘ciaranTest’ has both the Browse Project permission and the correct Issue Security Level:

A comment is added to the issue ‘SDJ-2’, where the user ‘ciaranTest’ is the Reporter:

A notification is sent by Jira to ‘ciaran@test.com' for this new comment:

If either the Issue Security level or Browse Projects permission were to be removed from the user ‘ciaranTest’, any future notifications would not be sent by Jira to this user.

 

JEMH Notifications

 

JEMH Notifications are slightly different due to the ‘Require Browse Issue’ setting found in the Notification Mapping. This means that having the Browse Projects permission is not always necessary, however the Issue Security level MUST be met for a JEMH notification to be sent, regardless of the ‘Require Browse Issue’ setting.

JEMH: Require Browse Issue

Require Browse Issue : ON

Browse Projects Permission

Issue Security Level

Notification Sent ?

Same behavior as Jira ?

Browse Projects Permission

Issue Security Level

Notification Sent ?

Same behavior as Jira ?

Require Browse Issue: OFF

The main difference, highlighted in yellow, is that with ‘Require Browse Issue’ turned off, users do not need the Browse Projects permission.

Browse Projects Permission

Issue Security Level

Notification Sent ?

Same behavior as Jira ?

Browse Projects Permission

Issue Security Level

Notification Sent ?

Same behavior as Jira ?

 

JEMH notification example

Using the same Service Management project, here is the default JEMH notification path showing how Issue Security, the Browse Projects permission and the ‘Require Browse Issue’ setting affects the notifications a user receives.

User ‘ciaranTest’ has both the Browse Project permission and the correct Issue Security Level:

In the JEMH Notification Mapping for this project, ‘Require Browse Issue’ is turned on:

Another comment is added to the issue ‘SDJ-2’, where the user ‘ciaranTest’ is the Reporter:

A notification is sent by JEMH to ‘ciaran@test.com' for this new comment:

If the Issue Security level or Browse Projects permission were to be removed from the user ‘ciaranTest’, any future notifications would not be sent by Jira to this user.

However, if the Browse Projects permission was removed, but also the ‘Require Browse Issue’ setting was turned off, notifications would continue to be sent, as long as the Issue Security level is still met.