So I generated a new atlassian-connect-express addon for Jira and defined the following routes.
app.get('/hello-world-authenticate', addon.authenticate(), function (req, res) {
res.json({"title": "protected using authenticate"});
}
);
app.get('/hello-world-check-valid-token', addon.checkValidToken(), function (req, res) {
res.json({"title": "protected using checkValidToken"});
}
);
app.get('/hello-world-public', function (req, res) {
res.json({"title": "public"});
}
);After registering the ACE add-on I get the following output, and I am able to cURL the public endpoint succesfully.
Local tunnel established at https://3c45bb5b.ngrok.io/
% curl https://3c45bb5b.ngrok.io/hello-world-public
{"title":"public"}
cURL commands towards the authenticated endpoints fail, which makes sense since no authentication information is provided.
% curl https://3c45bb5b.ngrok.io/hello-world-authenticate
Could not find authentication data on request
% curl https://3c45bb5b.ngrok.io/hello-world-check-valid-token
Could not find authentication data on request
I've been made aware that a JWT token can be requested issuing a POST command using basic authentication towards https://<your-id>.atlassian.net/rest/auth/1/session.
curl -H "Content-Type: application/json" -X POST -d '{"username":"<your-username>","password":"<your-password>"}' https://<your-id>.atlassian.net/rest/auth/1/session
{"session":{"name":"cloud.session.token","value":"<received-jwt-token>"}}Providing the JWT token to the above endpoints results in following output.
% curl "https://3c45bb5b.ngrok.io/hello-world-authenticate?jwt=<received-jwt-token>"
JWT claim did not contain the query string hash (qsh) claim
% curl "https://3c45bb5b.ngrok.io/hello-world-check-valid-token?jwt=<received-jwt-token>"
Could not find stored client data for atlassian. Is this client registered?
It seems I am unable to authenticate towards my ACE endpoints. What should be the correct procedure for authenticating ACE endpoints? What tokens should be set, and how should they be acquired?
I want my custom endpoints to be called based on a cron job so for simplicity I prefer autentication data being passed using the HTTP headers.
Source can be found at https://bitbucket.org/wvanvlaenderen/atlassian-connect-express-authentication-demo
