Restrict Jira JQL Search to Permissions of Requesting User

Question

I have a server that has a Jira account with full permissions to see all issues. Amongst other things, this server will be used to facilitate requests from an end user to search Jira for issues; this will be done via the Jira REST API. The end users for whom the requests will be facilitated for all have accounts on Jira with more restrictive permissions (i.e. they can't see all issues). Using the REST endpoint and JQL, how can I tailor my query on the server such that it performs the search, using the permissions that the end-user has? In other words, how can I tailor my REST query to only show users issues they have permissions to see even though the request (my server) has full permissions? This setup uses crowd for authentication identity management.

Sample query I'd like to restrict to the permissions of user "Bob"

http://kelpie9:8081/rest/api/2/search?jql=project=QA+order+by+duedate&fields=id,key

Workflow: Enduser -> Server -> Jira (REST)

Answer 1

The easiest way is probably to create additional users for your scripts that have the same permissions as your end users. When you authenticate your REST calls with the script user that corresponds to an end user, then JIRA will return only appropriate results. Whether this is feasible will depend on the number of different script users that you need.

An alternative is to keep using your superuser, but use more specific JQL queries depending on what the end user is allowed to see.