api methods do not work on behalf of the application

[wiktorryzhkov]

api methods crowd (GET /rest/admin/1.0/groups/{groupId}/users )

do not work on behalf of the application .  

I am trying to call api methods from my python application and they throw a 401 error. According to the documentation - this is caused by a lack of rights. But I have checked all the rights. All other methods work, except for the methods / rest / admin / **

From under the normal user account through curl these methods (/ rest / admin / **) -work.

version crowd -3.3.2

Help me please

[LynnG]

Yes, this behavior is expected in Crowd. The key distinction is:

• /rest/usermanagement/** is intended for application-based REST access.
• /rest/admin/** is intended for administrative operations, and Crowd docs state that non-usermanagement resources expect user credentials, with permissions based on that user’s permissions. [docs.atlassian.com]

So if your Python app authenticates with the Crowd application name/password, calls like this can fail:

HTTP

1

GET /rest/admin/1.0/groups/{groupId}/users

Show more lines

even though normal usermanagement APIs work.

Why your curl test works

You mentioned that the same /rest/admin/** method works from curl under a normal user account. That matches the documentation: admin APIs authenticate as a Crowd user, not as an application. [docs.atlassian.com]

So this works:

Shell

1

curl -u crowd_admin_user:password \

2

-H "Accept: application/json" \

3

"https://crowd.example.com/crowd/rest/admin/1.0/groups/123/users"

Show more lines

But this may fail:

Shell

1

curl -u application_name:application_password \

2

-H "Accept: application/json" \

3

"https://crowd.example.com/crowd/rest/admin/1.0/groups/123/users"

Show more lines

because application credentials are for the usermanagement API, not the admin API. Crowd’s REST documentation explicitly says the usermanagement resource expects application credentials, while other resources expect user credentials. [docs.atlassian.com]

What to use instead

Option 1: Use user credentials for /rest/admin/**

In Python:

Python

1

import requests

2

from requests.auth import HTTPBasicAuth

3

4

url = "https://crowd.example.com/crowd/rest/admin/1.0/groups/123/users"

5

6

response = requests.get(

7

url,

8

auth=HTTPBasicAuth("crowd_admin_user", "password"),

9

headers={"Accept": "application/json"}

10

)

11

12

print(response.status_code)

13

print(response.text)

Show more lines

Use a Crowd user that has the required admin or group-level admin permissions.

Option 2: Use /rest/usermanagement/** if you need application-based access

If your Python app should authenticate as a Crowd application, use endpoints under:

Plain Text

1

/rest/usermanagement/1/...

Show more lines

For example, Crowd 3.3.0 documents these group membership-related endpoints under usermanagement:

Plain Text

1

GET /rest/usermanagement/1/group/user/direct

2

GET /rest/usermanagement/1/group/user/nested

3

GET /rest/usermanagement/1/group/membership

Show more lines

These belong to the application-facing API. [docs.atlassian.com]

Also check these details

1. Use the right API namespace

   Application credentials:

   Plain Text

   1

   /rest/usermanagement/1/...

   2

   `

   Show more lines

   User/admin credentials:

   Plain Text

   1

   /rest/admin/1.0/...

   2

   ``

   Show more lines

2. Check the actual HTTP status

   Crowd’s general REST API guide says 401 Unauthorized can indicate invalid application name/password or that the application does not exist in the application-authenticated API context. It also documents 403 Forbidden for cases such as inactive application or caller IP not allowed. [developer....assian.com]

3. Make sure you are using groupId, not group name

   The admin endpoint is:

   Plain Text

   1

   /rest/admin/1.0/groups/{groupId}/users

   Show more lines

   so {groupId} should be the Crowd group ID expected by that admin API, not necessarily the group name.

Short answer

You cannot reliably call /rest/admin/** “on behalf of the application” using Crowd application credentials. For those endpoints, authenticate with a Crowd user account that has the required permissions. If you need application-based authentication, use the /rest/usermanagement/** APIs instead.