Allow to create ticket without login
Asked by Iris Ayelin:

Hi,

I'm looking for a way to allow people to create tickets on our project without having to log in to their accounts.

The idea is to generate a QR code that contains a URL leading to the portal. People can then scan this code to access the portal and submit a ticket.

Currently, the customer's permission is set to 'Allow customers to create an account,' which requires them to log in before creating a ticket.

I discovered an option to enable "Customers can access and send requests from the portal without logging in," but this permits external individuals to create a ticket on someone else's behalf.

Do you have any suggestions for achieving this without compromising security?

Thank you!


Answers:
author: Lisa Forstberg
body: Hi [@Iris Ayelin](/t5/user/viewprofilepage/user-id/5107223)

Just to be sure - this question is posted in the Jira product forum, but you are referring to the Jira service management product right? Only Jira SM projects have a portal.

If you want a Jira SM project to be open to the public and not require sign in you need to have these settings on:

"Customers can access and send requests from the portal without logging in" in the product overall configuration (cog \> product \> Jira Service Management \> Customer Access) plus ensure that your project also is set to Open for channel access.

With these settings on the reporter are allowed to add tickets without logging in or creating accounts, but they will be forced to add an email address in order to receive email notifications.

Yes, potentially the reporter of a ticket can choose to add another users email address there instead of its own, is that what is bothering you?

Here is a similar question <https://community.atlassian.com/t5/Jira-Service-Management/How-risky-is-it-to-have-a-customer-portal-set-to-Anyone-can/qaq-p/2150098>

br

Lisa

comments: author: Rilwan Ahmed
body: Hi [@Iris Ayelin](/t5/user/viewprofilepage/user-id/5107223) ,

You can enable the settings mentioned by [@Lisa Forstberg](/t5/user/viewprofilepage/user-id/5101516) directly in url https://\<*baseURL*\>.atlassian.net/jira/settings/products/servicedesk/customer-access

![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/339411i463DAB3F28BD9F23/image-dimensions/320x92?v=v2 "image.png")


author: Iris Ayelin
body: Hi,

Thanks for your answers!

[@Lisa Forstberg](/t5/user/viewprofilepage/user-id/5101516) Yes, I meant the Jira Service Management product.

I came across this option, but it's pretty troubling due to the security vulnerability. (External individuals can apply requests as internal users.)

Do you know of a more secure way to provide access to the portal without requiring a login? By "more secured," I mean there is no option to input an email address that links to the ticket as the reporter.

Perhaps there's a way to create a URL that bypasses the login or configure a specific authorized network for access?

I appreciate your help!


author: Lisa Forstberg
body: Hi,

Sorry there is a balance act on the three options:

1. allow for anyone that knows the URL to create an issue
2. force the users through a signup process before they are allowed to create an issue
3. have total control and invite only specific users.

But I am not really agreeing to the statement "External individuals can apply requests as internal users." The anonymous user cannot grant themselves some sort of internal user (ie agent) permission this way. They are not allowed to any other jira project than this, and only as a customer ("portal user")

The worst that can happen is that they will spam the system and someone else with notifications as if they create a lot of issues typing in an email address that isn't theirs. Option 2 would then be opening for a similar spam risk.

So for context. How should this QR code to the URL be distributed? How big is your intended audience? What is your options to test for a while to see if it actually gets out of hand? If it does then be prepared to change the permission of the portal, alternatively remove the portal totally.

br

Lisa


author: Rilwan Ahmed
body: Hi [@Iris Ayelin](/t5/user/viewprofilepage/user-id/5107223) ,

Enable Email requests for your project. Any user can just send email and Jira will create ticket.

Refer [Add a custom email account](https://support.atlassian.com/jira-service-management-cloud/docs/add-an-email-account/) and [How do customers send requests by email?](https://support.atlassian.com/jira-service-management-cloud/docs/how-do-customers-send-requests-by-email/) for more details

comments: author: Iris Ayelin
body: Hi [@Rilwan Ahmed](/t5/user/viewprofilepage/user-id/716861)

Thank you for your response, but unfortunately, it can't help me because it requires logging into the email account.

My goal is to create a QR code that links to the portal and enables users to submit a ticket without logging into Jira in a secure way.


Tags: cloud

jira-service-management

jira-service-management-cloud