Can all organisational administrators have visibility of OAuth 2.0 (3L0) applications configured?

[Paul Dow]

As an organizational administrator of our Atlassian products, I have successfully created and authenticated with two OAuth 2.0 (3LO) applications setup in the Developer Console. These support integration between Jira and an external system using the RestAPI. 

The issue is that no other organizational administrators are able to see (and therefore cannot modify) these OAuth applications. There is also no way for me to re-assign these OAuth Applications to another Jira administrator. We are using a password management program to share the Client ID, Secret, etc. with others that need access. 

I know that the Atlassian Developer Console does not support sharing OAuth 2.0 applications with other Jira administrators for collaborative management and that only me, as the creator, can manage these OAuth applications.

Will any consideration be made by Atlassian to add one or both of these as new features in the future?

For us this is a risk should I either not be available or leave the organization. We need all of our Jira administrators to be able to manage (or even be able to delete) OAuth applications.

[Chitra Nagdeo]

Hey @Paul Dow ,

Welcome to Atlassian Community Forum, My name is Chitra and I am part of Jira Cloud support team in Atlassian. I understand you want to enable Organisation Admin have visibility of OAuth 2.0 (3L0) applications configured on Atlassian Jira instance. I checked the details internally and based on the available information, not all organizational administrators automatically have visibility of all OAuth 2.0 (3LO) applications configured.

Here are the key points:

• OAuth 2.0 (3LO) apps are installed on a per-user basis. This means each user who wants to use a 3LO app must individually grant consent, and the app is only authorized for that user’s account. There is no indication that organizational administrators have a central dashboard or view to see all 3LO apps configured by all users in the organization 1.

• Enabling sharing or distributing a 3LO app does not make it globally visible or manageable by all admins; it simply allows more users to install it themselves 1.

• The management and visibility of 3LO apps are fundamentally different from Connect apps or OAuth 1.0 integrations, which can be centrally managed at the instance level 1.

Summary: Organizational administrators do not have automatic or centralized visibility of all OAuth 2.0 (3LO) applications configured by users in the organization. Each 3LO app is tied to the user who consented to it, and visibility is limited accordingly.

Thanks and Regards
Chitra Nagdeo
Atlassian Cloud Support
ATLASSIAN

[Paul Dow]

Thanks Chitra, I completely understand the current state. 

The reason for my post is that we want all organisational admins to be able to view and manage our OAuth applications in the Developer Console. Can we please request this as a future new feature for Atlassian to implement?

My concern is that if the person who creates them is unavailable or leaves the company then nobody else will have visibility and that then becomes a potential cyber risk for the organisation.