How to Use ScriptRunner for Customer-Org Restrictions, Group Sync, and the Koji Extension Fix in Jira (2026)

Lead

Automate customer organization restrictions, group sync, and Koji extension UUID fixes without manual admin work. Three scripts: (1) event-driven request-type restrictions, (2) hourly group sync from Okta or Workspace, (3) scheduled UUID reconciliation. Verified against ScriptRunner for Jira Cloud on 2026-05-04. For JSM tenants running 5 to 20 customer organizations.

Prerequisites

How ScaleIT handles this: See Jira Rescue

• Jira Cloud with JSM enabled
• ScriptRunner for Jira Cloud license
• Admin access to Jira Cloud
• For group sync: Okta or Google Workspace API credentials
• Basic Groovy scripting knowledge
• Access to Execution History logs

Recipe 1: Automate Request-Type Restrictions on Organization Changes

Script Listeners enforce request-type restrictions whenever a customer is added to an organization.

1. ScriptRunner → Script Listeners → Create Listener
2. Set event: Customer added to organization
3. In the script, read the organization metadata (custom field or Assets object) to determine entitled request types
4. Use Jira REST API (/rest/servicedesk/1/organization/{orgId}) to fetch organization details
5. Match request types from your lookup table (stored on the organization or Confluence page)
6. Call the request-type restrictions endpoint to update Groups that can raise with mapped request types
7. Set scope to Specific projects (recommended for JSM spaces)
8. Save

Outcome: When you add a customer to an organization, the portal automatically shows only their entitled request types within 30 seconds.

Recipe 2: Sync Customer Groups from Okta or Workspace Every Hour

Scheduled jobs run recurring scripts to keep portal access in sync with your identity provider.

1. ScriptRunner → Scheduled Jobs → Create Job
2. Set schedule: Every 1 hour (minimum interval; adjust as needed)
3. In the script:

• Call Okta API (https://your-okta-domain.okta.com/api/v1/groups) or Google Workspace Directory API
• Parse group membership from the response
• For each source group, find the corresponding Jira customer group using CustomerGroupService
• Diff current Jira membership against source membership
• Add customers in the source but not in Jira; remove customers who've left
• Write a log entry to your scriptrunner-audit project

1. Save and verify in Execution History

Outcome: Okta or Google Workspace becomes your single source of truth. Access changes sync hourly.

Recipe 3: Fix Koji Extension UUID Mismatches

Koji stores customer group references by UUID. When groups are renamed or recreated, the UUID becomes stale and breaks the portal.

1. ScriptRunner → Scheduled Jobs → Create Job
2. Set schedule: Every 1 hour (or 4 hours to balance load)
3. In the script:

• Enumerate all portals configured in Koji (stored in Assets or custom fields)
• For each group reference, attempt to resolve the UUID using CustomerGroupService.getGroupByUuid(uuid)
• If the UUID is not found, look up the group by name: CustomerGroupService.getGroupByName(name)
• Write the corrected UUID back to the Koji configuration
• Log the correction to your audit project

1. Save

Outcome: Stale Koji UUIDs are detected and fixed automatically. Customers no longer see "UUID not found" errors.

Verify

• Check Execution History to confirm each script has fired successfully
• Recipe 1: Add a test customer to an organization; verify the portal shows only their entitled request types within 30 seconds
• Recipe 2: Check your audit project for the latest successful sync log
• Recipe 3: In Koji's portal settings, confirm no "UUID not found" warnings appear

Troubleshooting

Listener or Job Never Fires

Cause: Script syntax error or missing permissions. Fix: Check Execution History, click the failed run, and read the error. Common issues: missing Okta/Workspace API token or incorrect REST API URL. Correct and re-save.

Sync Takes 5+ Minutes

Cause: Job interval is too long or listener is queued behind others. Fix: For Recipe 2, confirm the interval is 1 hour. For Recipe 1, consolidate listeners on the same event into a single script.

Koji UUID Fix Not Applied

Cause: Koji configuration is cached in the browser. Fix: Clear browser cache and reload the Koji portal settings page. Verify the script writes to the correct configuration field (check Koji's docs for the exact Assets or custom field name).

CTA

ScriptRunner pays for itself the first week. If you need help scoping automations, writing scripts, or auditing your library for safety and cost, reach out to ScaleIt for a free consultation — we can show you which scripts deliver the fastest ROI.