Java JiraRestClient callouts are now 403ing after implementing SAML for authentication. Any advice?

Question

Hello all,

My team has a java application that makes REST api calls to our Jira instance. Very recently the Jira admins migrated to a new SSO solution; formerly we were using Crowd, now its SAML with LDAP for the IdP.

My understanding about this new setup was that although we were handling the front-end users differently, the apis would still work with basic http auth:

https://confluence.atlassian.com/adminjiraserver/saml-sso-for-jira-data-center-applications-938847031.html

* Use SAML as primary authentication – in this mode, all browser-based users will be redirected from the application's login screen to the IdP to log in. It's still possible to authenticate by:
* Basic Auth
* Form-based auth via dedicated REST endpoint
* Existing Remember Me tokens

You should only enable this mode once you've verified that SAML authentication is working as expected.

I've verified that this is in fact how our environment is configured. However, our Java-based api calls are now returning 403s. I've looked into the steps for creating a SAML session and using the jsessionid/cookie and frankly it looks cumbersome and doesn't play nicely with java JiraRestClient library which doesn't come out the box supporting said cookie without serious customization.

Our preferred solution would be exactly as is described in the documentation above. We've verified that SAML is working as expected for front-end users, but I'd like to exclude rest calls from needing to go through SAML and simply continue using the basic auth. Any ideas as to what we're missing?

Dylan Slack · Answer

Afternoon Daniel,

Just FYI my setup and issue is very related to this post which was answered by you: https://community.atlassian.com/t5/Confluence-questions/Confluence-Data-Center-REST-API-with-SAML-Auth/qaq-p/1030973

Everything I'm trying to do is mirrored here except we're talking about Jira instead of Confluence. Right now the only way we can get api calls to first generate a jessionid and use it as cookie-based authentication via curl. But this is a huge lift for us from the java perspective and would prefer Basic Auth still work as described in the post above.

Does your answer apply to Jira Data Center as well? Is there something we need to check in terms of configuration?

Dylan Slack · Answer

Daniel,

It is in fact a Jira Data Center (apologies, the tagging only seemed to offer cloud vs server), so the above documentation probably applies here. I could see the toggleable options between SAML as primary and secondary in the administrative tab that the admin was showing me.

Apologies I'm not a Jira expert by any means, just a developer that wants to keep my rest api calls to a SAML-enabled Jira Data Center operational with minimal effort.

Daniel Eads · Answer

Hey Dylan,

Your question is tagged for Jira Server - is this what you have (vs Jira Data Center)?

The documentation you linked is for the Jira Data Center SAML authenticator. If you have a Jira Server license instead, you'll need to use one of the SAML apps on the Atlassian Marketplace. Knowing which app you're using will help determine the steps necessary to either bypass SSO for API calls or troubleshoot what's happening.

Cheers,
Daniel | Atlassian Team