Secure authentication method to import Markdown-Files as Confluence Pages

[Michael Pfannkuchen]

Hello together,

we just want to import markdown-formatted files as Confluence pages every night automatically.

Just thought at it as easy going Python programming task, but by now, we're having trouble with script authentication against Confluence Rest API. We tried OAuth2 secrets, scoped API tokens, Service Accounts, scoped user tokens ... and as result we only got 401 or 403 errors.

Currently the only way to run the Python application is using the classic token of an Org-Admin for authentication - not really an acceptable solution, I mean.

Does anyone have a more feasible authentication solution for our use case?

Many thanks for your help: Michael

[Arkadiusz Wroblewski · Accepted solution]

Hello @Michael Pfannkuchen 

for a nightly import, a dedicated service account is definitely the cleaner and safer option than using your own Org Admin token.

From what you described, I wouldn't blame the Python part and more at how that service account is set up. If your personal token works but the service account gets 401/403, the probably reason is that something is still missing around product access, permissions, scopes, or even the endpoint you are calling.

A few questions that would help narrow it down. did the service account already get Confluence product access? does it have permission in that target space to create pages? which endpoint are you calling with that account? and are you using a scoped token or OAuth for it?

Also, since you mentioned Product Admin, can you actually create and manage the service account yourself in Atlassian Administration, or does an Org Admin need to do that part for you?

[Michael Pfannkuchen]

Hello Arkadiusz,

many thanks for your quick response.

I just recreated the whole test environment:

1. New ServiceUser with Confluence Product access as Guest and OAuth Credentials; instead of classic scopes I applied the granular scopes only: delete:content:confluence, read:content:confluence, read:permission:confluence, read:user:confluence, write:content:confluence
2. Added the service user directly to one Confluence Space; so it should be clear, that this user is known to Confluence

After that, I managed to create an bearer access_token from the OAUTH credentials and use that in the curl request below.

Unfortunately no change - always I get the error message "Unauthorized; scope does not match"

Do you have any ideas about what do I have to change here?

Many thanks in advance again: Michael

$ curl --request GET --url https://api.atlassian.com/ex/confluence/${TENANT_ID}/wiki/api/v2/pages/266338305 --header "Authorization: Bearer ${ACCESS_TOKEN}" --header 'Accept: application/json'
{"code":401,"message":"Unauthorized; scope does not match"}

[Arkadiusz Wroblewski]

@Michael Pfannkuchen 

for your current test, I would add read:page:confluence.

And for the later create call, I would add write:page:confluence.

[Michael Pfannkuchen]

Hello @Arkadiusz Wroblewski ,

you made my day :-).

Just added the right scopes and the access works like intended. And the setup is quite save: with limited access rights and restricted to one space.

Thank you very very much.

For reference I added the the actual given scopes below.

Best regards: Michael

----------------------

"scope":"delete:attachment:confluence delete:comment:confluence delete:content:confluence delete:page:confluence read:attachment:confluence read:comment:confluence read:content:confluence read:folder:confluence read:hierarchical-content:confluence read:inlinetask:confluence read:label:confluence read:page:confluence read:permission:confluence read:space-details:confluence read:space.permission:confluence read:space:confluence read:task:confluence read:user:confluence write:attachment:confluence write:comment:confluence write:content:confluence write:folder:confluence write:label:confluence write:page:confluence write:task:confluence"

[Arkadiusz Wroblewski]

@Michael Pfannkuchen 

Happy to hear that.