How to restrict issue cloning in Jira

Summary

There is no clone permission in Jira.

We've seen many instances making use of workflow-based permissions such as jira.permission.createclone.denied but this has been working through a coincidence.

The how-to article title is misleading on purpose to draw attention to what's explained here.

Environment

All Jira Core Data Center versions 7.x ,8.x., 9.x, 10.x

Jira Cloud, Jira Service Management Cloud

Solution

Jira doesn't have a Clone permission, only a Create permission.

The way Jira implements permission checking, the property jira.permission.createclone is interpreted as the jira.permission.create property — Jira ignores whatever follows "create."

Making use of this property in the first status of the workflow causes:

• Clone operations to be forbidden in the UI — as expected.

• Clone operations to be forbidden through REST API — as expected.

• Create operations to be forbidden through REST API — unexpected!

• Usage of /createmeta/ endpoint returns with empty fields — unexpected!

Yet create operations still work through the UI — and this is the actual issue!

Create operations through the UI don't check the workflow create permission (just the Project's create permission), and this has lead to a major misunderstanding that jira.permission.createclone actually works. Well, it does, but it's a coincidence (as long as you don't create issues through REST API).

For reference: JRASERVER-72517 - Workflow Permissions around issue creation are not enforced consistently between the UI & REST API

In short: