REST API authentication/access for external systems

Question

If we have an external product (an identity manager) that needs to connect to Jira cloud's REST API to pull down user information, groups, and application roles on a schedule, which authentication method is best suited for this? This process is non-interactive.

It looks like an API token with basic auth, where we generate an API token under an administrative user (that we consider a service account), would work.

OAuth 2.0 3LO with refresh tokens could work in scripts but this method does not give us access to some REST endpoints, like removing a user from a group - so that one is out.

I don't think a connect framework app would give us anything more than basic auth would, except for getting user's email addresses where because of GDPR the get email endpoints are only accessible via an app that has been whitelisted/approved by Atlassian.

Ritesh Khatri · Answer

can anyone help me to call jira api from external systems.

Issue with OAuth 2.0 Integration for Jira API Call... (atlassian.com)

Andy Heinzer · Answer

Hi Ryan,

I understand that you want to setup a custom integration between Jira Cloud and your own program.  There are a couple of different ways to manage the authentication aspect here in regards to using the REST API.

The easiest method to setup is clearly the Basic auth for REST APIs.  This method relies upon you creating an API token for your account (presumably a site-admin account).  Using this method would require you to create a string composed of youremailadress:yourAPItoken that is then base64 encoded.  You can then pass that encoded string as an authorization header to your REST calls.   But we acknowledge this method is not the most secure.

While OAuth is a more secure method of managing authentication, it is more complex to setup. And from reading your requirements, it sounds like the scopes that OAuth implements might restrict some of the data you want to gather here.  There is note of this in Security for other integrations.

Authorization for OAuth 2.0 authorization code grants is implemented via scopes. Scopes statically specify the maximum set of actions that an app may perform (see scopes). Note, OAuth 2.0 authorization code-only scopes are different to Connect scopes.

To learn more, read OAuth 2.0 authorization code grants (3LO).

Which suggests that users not creating a connect app or other app use OAuth 1.0 instead.  Perhaps this other alternative could still provide you what you need here.

Andy