Custom Jira Charts for Confluence

Hidden_User_Impersonation_FAQ

Owned by Old Street Apps
Last updated: Dec 06, 2022 by Morgan Folsom (Unlicensed)
3 min read

No. By default, User Impersonation is disabled and no users have access to Impersonate themselves, or any other users.

To give users access to this feature individual users and/or groups must be added to the User Impersonation Permissions in the Custom Jira Charts administration settings.

⠀

When a user builds a Custom Jira Chart in the Confluence editor and clicks Insert or Save a number of very important steps happen:

  1. The User Impersonation permissions of the user are checked again to ensure that they still have the correct permissions to create a chart impersonating the selected user

  2. Every parameter from the chart is used to generate a unique hash. This includes:

    1. The source JQL or Saved Filter for finding issues

    2. The Chart By and Group By field selections

    3. All segment configuration (color, names, order, etc.)

    4. The page ID of the page the chart is being created on

  3. This hash is sent to the database

    1. On Confluence Server and Data Center this is the same database as your Confluence instance

    2. On Confluence Cloud, this hash is stored on the Custom Jira Charts database

This means that, if anyone attempts to change anything about the chart, even the color of a segment, the hash that is created won’t match the has stored in the database and there will be an error.

User Impersonation is secure by design so that only the Jira data specified by the creator of the chart is displayed.

⠀

When User Impersonation is enabled, anyone who has the View permission on the Confluence page will be able to view the Custom Jira Chart.

This means that anyone who can view the Confluence page, even Confluence users without Jira licences are able to view the Custom Jira Chart.

If your Confluence instance has public access enabled then User Impersonation will also allow anonymous users to view charts on pages where the anonymous view permission is enabled

⠀

No. When a chart with User Impersonation is saved, a unique hash is generated specifically for that chart configuration. This unique hash means that there can be no changes made to the chart unless the user trying to edit the chart has the correct permissions. If a user without the correct User Impersonation permissions tries to edit a chart, this is the message they will see:

 

If a user clicks “Remove User Impersonation” then the chart will revert to the default setting of no impersonation and load the data as the current user.

⠀

No. When the data source for a Custom Jira Chart is a Simple Search macro then User Impersonation is disabled. This is because the Simple Search macro allows for arbitrary JQL to be run which would bypass the security restrictions we have built for User Impersonation, allowing any user viewing the chart to write any JQL query.

This is something we are looking to improve in future but for now, this feature is disabled.

⠀