How to restrict issue cloning in Jira
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
There is no clone permission in Jira.
We've seen many instances making use of workflow-based permissions such as jira.permission.createclone.denied but this has been working on a coincidence.
The how-to article title's misleading on purpose to draw attention to what's explained here.
Environment
All Jira Core versions 7.x ,8.x., 9.x, 10.x
Solution
Jira doesn't have a Clone permission, only a Create permission.
The way Jira implements permission checking, the property jira.permission.createclone is interpreted as the jira.permission.create property — it ignores the rest of the word.
Making use of this property in the first status of the workflow causes:
- Clone operations to be forbidden in the UI — as expected.
- Clone operations to be forbidden through REST API — as expected.
- Create operations to be forbidden through REST API — unexpected!
- Usage of
/createmeta/endpoint returns with empty fields — unexpected!
Yet create operations still work through the UI — and this is the actual issue!
Create operations through the UI don't check the workflow create permission (just the Project's create permission), and this has lead to a major misunderstanding that jira.permission.createclone actually works. Well, it does, but it's a coincidence (if you don't create issues through REST API).
For reference:
In short:
There is no way to restrict the cloning of issues in Jira in a reliable way.
Jira doesn't have a Clone permission — only a Create permission.
Requests for a "clone permission" have been dismissed in the past.