0

I have a Jira site where my customers' employees can open bugs, view bug statuses and so on.

I manage these users inside my Jira (external users) and they have username and password with limited access rights. About 100 customers, between 5-10 users per customer.

My questions are:

  1. How can i verify that they still work for my customer and didn't move to work for other company?

  2. Or maybe they moved in to different role in the organization and don't need to access Jira any more?

1 is more critical then 2.

Thank you

A

1

It'd probably be very frustrating to do it for that many customers, but in theory you could do it via IP address filtering (only allow signins from customer IPs) and trust your customers to deny network access / VPN for people who have left.

You can also require that people sign up / sign in with their company (i.e. your customer) email address. Then you could do something to make accounts deactivate unless the users click a "yes, I still have this account" link (with a unique random token in it) every so often, like 1/month, and only sent those links to customer email addresses. That'd take some setup work and be a little annoying to the users, but it would limit the amount of time somebody could get access.

If your customers are using something like Google Apps (or whatever they call it now) and the users are using SSO to sign into Jira, then you're probably fine; your customers should revoke access to the accounts of anybody who leaves, which will also mean they can't access your Jira. That doesn't work for usernames and passwords, though.

Alternatively, you can just ask your customers to tell you when people leave (or change roles in a meaningful way). It's not foolproof, of course, but presumably they already have a system in place for handling employees leaving; they can just add "notify the Jira admin" to that list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.