Scriptrunner - client must be authenticated to access this resource

[Tom Lister]

Hi I'm converting my admin scripts from server to cloud format where possible

I've got hung up on the message in the title when running in the script console. Script below.

I've refreshed browsers, logged out and in again. Tried in Safari and Chrome. I have admin rights in the cloud instance.
Something obvious I'm missing ?

String[] userList = [

"listertuk@domain.com"

]
String[] groups = ["My%20PMs"]

userList.each() {user ->
def result2 = get('/rest/api/3/user/search?query=' + user)
.header('Content-Type', 'application/json')
.asObject(List)

assert result2.status == 200

logger.info(user + " result2: " + result2.body)
result2.body.each() { userId ->
String accountId = userId.accountId
logger.info("accountId " + accountId)
groups.each() {groupname ->
String groupsUrl = "/rest/api/3/group/user?groupname=${groupname}"
logger.info('url: ' + groupname + ' = ' + groupsUrl)

def result3 = post(groupsUrl)
.header('Content-Type', 'application/json')
.body([
accountId: accountId
])
.asString()

assert result3.status == 200

}
}
}

output:

Serializing object into 'interface java.util.List'
GET /rest/api/3/user/search?query=listertuk@gmail.com asObject Request Duration: 788ms
listertuk@gmail.com result2: [[self:https://tom-lister-dev.atlassian.net/rest/api/3/user?accountId=557058:ebde908e-e998-4fcb-8c8d-7d0076732fa4, accountId:557058:ebde908e-e998-4fcb-8c8d-7d0076732fa4, accountType:atlassian, emailAddress:, avatarUrls:[48x48:https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net/557058:ebde908e-e998-4fcb-8c8d-7d0076732fa4/3425b193-d1c2-4241-8a66-dc6c88b274c6/48, 24x24:https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net/557058:ebde908e-e998-4fcb-8c8d-7d0076732fa4/3425b193-d1c2-4241-8a66-dc6c88b274c6/24, 16x16:https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net/557058:ebde908e-e998-4fcb-8c8d-7d0076732fa4/3425b193-d1c2-4241-8a66-dc6c88b274c6/16, 32x32:https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net/557058:ebde908e-e998-4fcb-8c8d-7d0076732fa4/3425b193-d1c2-4241-8a66-dc6c88b274c6/32], displayName:Tom Lister, active:true, timeZone:Europe/London, locale:en_US]]
accountId 557058:ebde908e-e998-4fcb-8c8d-7d0076732fa4
url: My%20PMs = /rest/api/3/group/user?groupname=My%20PMs
POST /rest/api/3/group/user?groupname=My%20PMs asString Request Duration: 723ms
POST request to /rest/api/3/group/user?groupname=My%20PMs returned an error code: status: 401 - Unauthorized
body: {"message":"Client must be authenticated to access this resource.","status-code":401}
Assertion failed: 

assert result3.status == 200
       |       |      |
       |       401    false
       status: 401 - Unauthorized
       body: {"message":"Client must be authenticated to access this resource.","status-code":401}

Class: com.adaptavist.sr.cloud.events.ConsoleScriptExecution, Config: [userTriggered:true]

[Michael Wan]

Hi @Tom Lister  I understand this is an old issue, I encounter this exact same issue in 2024. I was wondering if you figured out how to fix this? 

[Kristian Walker _Adaptavist_]

Hi Tom,

I can confirm in the example above the API causing the error was the Add User to Group Rest API and ass the linked documentation page states, Atlassian do not allow connect apps to use this resource.

This means the API cannot be called from ScriptRunner.

I hope this information helps.

Regards,

Kristian