How can we keep our api callouts unimpacted by the transition to SAML?

[Dylan Slack]

Hello all,

My team has a java application that makes REST api calls to our Jira instance. Very recently the Jira admins migrated to a new SSO solution; formerly we were using Crowd for authentication, now its SAML with LDAP.

My hopes for this new setup was that although we were handling the front-end users different, the apis would still work with basic http auth:

https://confluence.atlassian.com/adminjiraserver/saml-sso-for-jira-data-center-applications-938847031.html

• Use SAML as primary authentication – in this mode, all browser-based users will be redirected from the application's login screen to the IdP to log in. It's still possible to authenticate by:
• Basic Auth
• Form-based auth via dedicated REST endpoint
• Existing Remember Me tokens

You should only enable this mode once you've verified that SAML authentication is working as expected.

I've verified that this is in fact how our environment is configured. However, our Java-based api calls are now returning 403s. I've looked into the steps for starting a SAML session and using returned jsessionid/cookie to make the calls via Java and frankly it looks cumbersome and doesn't play nicely with java JiraRestClient library which doesn't come out the box supporting said cookie without significant customization.

Our preferred solution would be exactly as is described in the documentation above. We've verified that SAML is working as expected for front-end users, but I'd like to exclude rest calls from needing to go through SAML and simply continue using the basic auth. Any ideas as to what we're missing?

[Italo Qualisoni [e-Core]]

Hi @Dylan Slack ,

I'm checking the documentation and they say that it's possible that you might need to reset the user's CAPTCHA  , can you verify if is this your case?

When using SAML as primary authentication and you have CAPTCHA enabled in the application, users that use HTTP basic authentication (for example in REST resource calls) may get locked out if they enter an incorrect password too many times. In these cases, an administrator will need to reset the user's CAPTCHA in the user list screen.

[Dylan Slack]

I don't recall captcha being enabled, but I will definitely verify and report back.