Project permissions
In order for a partner to have access to a Jira project, the project must support access by non-Red Hatters. Using Red Hat Standards (internal Red Hat page), this means that the project's permission scheme should be OJA-PRMS-002 or OJA-PRMS-003. Projects with OJA-PRMS-001 applied do not support partner access.
User/Group role mappings
Beyond having the right permission scheme applied, projects must also have the right user/group role mappings configured to allow the right level of access. In most cases, this means adding individual partner users or partner groups* to the Users role, which (assuming OJA-PRMS-002 or OJA-PRMS-003 is applied) provides permissions to:
- Browse issues they have access to view
- Create new issues
- Set the issue security level on issues they can access
- Be assigned to issues they have access to view
- Add comments and attachments to issues they have access to view
- Link to other issues they have access to view
- Manage watchers on issues they have access to view
*A note on partner groups
When onboarded, many partners are added to a partner confidential group that is synced to Jira. If that did not happen, Red Hatters can request that a new partner group be created in Jira, and there is the option to have it automatically populated by domain so that when a new partner user logs into Jira with the specified domain (@xyz.com), they are automatically added to their respective partner group. See Managing partner interactions in Jira (internal Red Hat page) for more details.
Note also that Jira can sync groups from Rover. Ideally, partner users use their partner account that has the domain of their partner company. However, partner engineers (a type of partner user) have redhat.com email addresses and sometimes use those for their Jira accounts. These partner engineers can be added to Rover groups that can also sync to Jira.
Issue security
Partners may not have access to all issues in a project due to the security level applied to each issue. Red Hat partners will not have access to issues with the following Red Hat Standard security levels (internal Red Hat page) applied:
- Red Hat Employee
- Embargoed Security Issue (unless they are explicitly added to a user picker field on the issue)
- Red Hat Engineering Authorized (unless they are the reporter or added to the Contributors field)
- Restricted (unless they are explicitly added to a user picker field on the issue)
- Team (unless they are explicitly added to a user picker field on the issue or have the Scrum Master, Developer, or Administrator project role)
Typically, partners are given access to issues in one of two ways:
- the ticket is unrestricted (no security level applied) or
- the security level is set to Red Hat Partner*, and the partner user has been added to the Contributors field or the partner group has been added to the Contributing Groups field
*A note on the Red Hat Partner security level
Because Jira users can only set the security level of an issue to levels that they have access to, it's possible that not everyone will see Red Hat Partner as an option in the Security Level field. If a Red Hatter cannot set the issue to Red Hat Partner or see an issue where the security level is set to Red Hat Partner, it's likely because they are not in the proper group. More details follow:
The ability to see and work on partner bugs requires that users be a member of the Red Hat Bugzilla See Partner Bugs Jira group (which underlies Red Hat Partner security level). This group is fed by the LDAP group bugzilla-see-partner-bugs.
To be added to the see_partner_bugs group in Bugzilla, you must apply for the packager role (note that members of the Red Hat Support may choose the support_staff role). Access to that role in Bugzilla will grant you access to the see_partner_bugs Bugzilla group, which in turn feeds the LDAP group bugzilla-see-partner-bugs. Access to this LDAP group provides access to the Jira group Red Hat Bugzilla See Partner Bugs. To access roles, go to bugzilla.redhat.com > My Links > Workflows > Request Group Membership.
See Partner bugs for more details about the restrictions in place for broad access to partner issues in Jira.
Additional optional configurations
Automation can help streamline access to issues in Jira. There are a few ways to go about this:
- If the partners working in your project use their partner company email addresses for their Jira accounts, PME can enable automation that automatically sets the security level to Red Hat Partner and automatically sets the Contributing Groups field to the appropriate partner group when a person from the same domain opens a new Jira ticket. See Managing partner interactions in Jira (internal Red Hat page) for more details.
- Project admins can create custom automation rules to set the security level to Red Hat Partner and the Contributors and/or Contributing Groups field as appropriate based on a specific trigger.