Is it a bug or a feature that adding worklog in REST API ignores the author in the POST body?

[Stephen Trigg]

As part of a migration from Clearquest to JIRA, we're attempting to retain time entries logged against issues for specific users.

When adding worklog entries through REST API, the author and update author JSON data structures are ignored and the authenticated user details are used instead.

Is that by design or by flaw? I can imagine it being prevented by default as a security issue - in which case, is there a way to enable it?

[Andy Heinzer]

Hi Stephen,

This is a known limitation within Jira at the moment.  I would recommend checking out this suggestion (feature request) https://jira.atlassian.com/browse/JRASERVER-30197

There is another issue connected to that in that connect project, however this only appears to apply to the Connect framework which works for Jira Cloud, but not Jira Server.

I suspect that there is an element of design to the way this is implemented in Jira.  There are certainly security concerns with allowing users to impersonate others in regards to actions taken.  

From researching this a bit, it looks like there is a marketplace plugin that allows you to impersonate REST actions as other users, perhaps the Sudo for Jira plugin might help in this case.