Automation for Jira API Authentication - CLOUD

Markus_rixsng

Hey,

Starting a thread to hear what other Jira Admins/Users are doing to tackle this...

Keen to hear how you protect the base64 encoded authentication inside your A4J rules?

Occurred to me that maybe an attribute insight an Insight Object inside a locked down schema could potentially work? I just worry about project admin's accessing the rule and using the auth inside the web request. 

Aware it could be set as a global rule to prevent project admin's accessing but still not really great from a security perspective

Mykenna Cepek

Interesting question! Sounds like a good Product Suggestion to offer to Atlassian.

Thinking this through, I don't see a way to truly lock this down with Automation as provided today. If the rule is able to look up the value and use it, then it's either exposed or easy to expose.

As you say, a project admin having access to a (project-specific) rule means the content of that rule (and the rule itself) is vulnerable. For example, a project admin could just add an "Audit Log" (or other) action to expose the value, no matter how tricky the rule was in retrieving/decoding/etc that value.

This suggests that the rule itself needs to be secure, leading back to your global rule approach (which simply reduces the scope of admins with access). However, this approach isn't a slam dunk, because:

• A rule set to "Multiple projects" but with only one project listed will revert to being set to a "Single project" (once you sneak past the first warning it gives).
• Multiple project rules can cause automation limits to be exceeded (for non-Enterprise level plans).

Interested to see if anyone else has ideas on this!