How to find what Projects a Group has access too (based on Roles) in CLOUD?
Asked by Darryl Lee:

Wow, got some good suggestions to my Question as I was typing it, but alas, I need a solution for Cloud:

Back in 2018, Michael [asked](https://community.atlassian.com/t5/App-Central-questions/Groovy-Find-group-in-Project-Role-and-add-another-group-into/qaq-p/779630):
> I would like to pull a list of all project roles where the "staff" group is located and add the "Employees" group into the role as well. Where do I even start? I'm hoping for a groovy solution to run in Script Console.

That's *exactly* what I want to do, except... I'm on Cloud. So the awesome solution that [@Ivan Tovbin](/t5/user/viewprofilepage/user-id/503118) gave will very likely not work, since I won't have access to the various internals that you have with on-prem Jira.

Whilst we were still on Server (which is when I *should* have made this change), I found this great article, which tells you how to [Find All Projects with a Specific Project Role.](https://blog.isostech.com/finding-all-projects-where-a-project-role-is-used)

I was able to hack it to just print out matches for the particular Group I was looking for:

```
import com.atlassian.jira.component.ComponentAccessor;import com.atlassian.jira.project.Project;import com.atlassian.jira.project.ProjectManager;import com.atlassian.jira.security.roles.ProjectRole;import com.atlassian.jira.security.roles.ProjectRoleActors;import com.atlassian.jira.security.roles.ProjectRoleManager;import com.atlassian.jira.security.roles.RoleActor;
def roleName = "Roku"
StringBuilder output = new StringBuilder();
ProjectManager projectManager = ComponentAccessor.getProjectManager();
ProjectRoleManager projectRoleManager = (ProjectRoleManager) ComponentAccessor.getComponentOfType(ProjectRoleManager.class);
//gets all project roles
def projectRoles = projectRoleManager.getProjectRoles()
//for each project
for(Project project : projectManager.getProjectObjects())
{   //and each project role
    for(ProjectRole projectRole: projectRoles)
    { 
        if(projectRole.getName() == roleName){
            //see if that project uses the project role
            def ProjectRoleActors projectRoleActors = projectRoleManager.getProjectRoleActors(projectRole, project)
            for (RoleActor actor : projectRoleActors.getRoleActors()) {
                if(actor.getDescriptor() == 'Roku Users')
                    output.append(project.getKey()).append("\n")
                }
        }
    }
}
return output.toString();
```

BUT, yeah, now I'm on Cloud, so that's not gonna work.

So one of the other suggestions I got was: [How to identify group usage in Jira Cloud?](https://community.atlassian.com/t5/Jira-Service-Management/How-to-identify-group-usage-in-Jira-Cloud/qaq-p/1786853), where [@Ang?lica Luz](/t5/user/viewprofilepage/user-id/986290) points to this ticket: [JRACLOUD-71967 - Group usage - List of project permission per group](https://jira.atlassian.com/browse/JRACLOUD-71967)

Basically, Cloud lost the functionality that was on Server/DC, to see all the Permissions (and Notifications, and Issue Security) Schemes that a Group has, like this:

![Screenshot 2024-07-25 at 10.31.17?PM.png](/t5/image/serverpage/image-id/338066i19C59561038C2FEA/image-size/large?v=v2&px=999 "Screenshot 2024-07-25 at 10.31.17?PM.png")

BUT ACTUALLY, because I folllow best practices (like [@Jimmy Seddon](/t5/user/viewprofilepage/user-id/512822)'s [here](https://community.atlassian.com/t5/Jira-articles/Jimmy-s-Jira-Permissions-Tips-amp-Best-Practices/ba-p/1922363)) I don't put Groups in Permission Schemes? **I put them in Roles.**

But Atlassian has not seen fit to show Groups that are in Project Roles. There's probably a ticket for that too.

I GUESS I could iterate through EVERY project in Jira using ACLI and do:

```
acli -a getProjectRoleActorList --project SAM --role Roku --select "Group: Roku Users"
```

But man, that's ugly.

Any other ideas?


Answers:
author: Darryl Lee
body: Ugh, yeah, ok so with 799 projects, this is gonna take a while, but it seems to be working:

```
acli -a runFromProjectList --common "-a getProjectRoleActorList --project \"@project@\" --role \"Roku\" --select \"5:Roku Users\" --file roku-user-roles.txt --append" 
```

Credit to [@Michael Kuhl _Appfire_](/t5/user/viewprofilepage/user-id/3467229) for the showing me that runFromProjectList without any other args will apply to ALL projects, and oh, he was answering a very similar question:

* [Is it possible to generate a list of projects with groups/roles granted access to it?](https://community.atlassian.com/t5/Jira-questions/Is-it-possible-to-generate-a-list-of-projects-with-groups-roles/qaq-p/1153804)

Keen observers will note I had to change my **--select** parameter from "Group" to "5". That was because of this error:
> Client error: Columns must be specified by number when append is also specified. ACLI-185 has more details on this permanent restriction.

Michael can you tell me more about ACLI-185? I can't find it. :-}

comments: author: Darryl Lee
body: ARGH. Gotta love having to brute force the REST API and then getting blocked:
> Client error: Invalid request: java.net.SocketException: Operation timed out
>
> Client error: 1 actions failed, 253 actions were successful

Looks like I'm gonna have to break my list of Projects into chunks. \*SIGH\*.

Maybe I can come up with a SQL query to ask Support to run for me. Some combination of these two:

* [How to identify which Groups have access to a Project in JIRA](https://confluence.atlassian.com/jirakb/how-to-identify-which-groups-have-access-to-a-project-in-jira-884354938.html)
* [How to get a list of permissions granted to groups assigned to Project Roles.](https://confluence.atlassian.com/jirakb/how-to-get-a-list-of-permissions-granted-to-groups-assigned-to-project-roles-790630266.html)

Heck, maybe if they're doing that they can also do the bulk add to Project Role for all the projects my query finds?


author: Darryl Lee
body: Welp, I'm resorting to just doing it manually. Here's my process:

```
acli -a getProjectList --file projectlist.txt
```

You then need to edit projectlist.txt and change the header field "Key" to "project" and then run:

```
acli?-a runFromCSV --file projectlist.txt --common "-a getProjectRoleActorList --role \"Roku\" --select \"5:Roku Users\" --file roku-user-roles.txt --append"
```

And then you let it go, until it inevitably fails. :-{

```
Run: --project "DSACMD" -a getProjectRoleActorList --role "Roku" --select "5:Roku Users" --file roku-user-roles.txt --append

Client error: Invalid request: java.net.SocketException: Operation timed out

Client error: 1 actions failed, 57 actions were successful from file: /Users/darryllee/Library/CloudStorage/OneDrive-RokuInc/roku/jira-users-cleanup/projectlist.txt
```

YOU then edit **projectlist.txt** to remove all the projects after the header row up to the project that it failed on (in my case "DSACMD").

Then you run it again:

```
acli -a runFromCSV --file projectlist.txt --common "-a getProjectRoleActorList --role \"Roku\" --select \"5:Roku Users\" --file roku-user-roles.txt --append"
```

Rinse. Repeat. \*Sigh\*.

PRO-TIP: If you use [ACLI Shell](https://bobswift.atlassian.net/wiki/spaces/ACLI/pages/2424143981/ACLI+Shell) you can easily hit the up-arrow key to bring up the last command and re-run it (after you edit the **projectlist.txt** to remove projects that have already been checked).


Tags: cloud

jira-cloud