HTTPBasic token authentication for JIRA server?

Question

My company uses JIRA server 8.20.7.  I have API tokens created using our web interface.

I've connected to REST API using OAuth + token, and I've also connected using HTTPBasic + password.

Is it possible to connect using HTPPBasic + token for JIRA server instances?  JIRA Cloud supports HTTPBasic authentication with token by replacing your password with the token string.  Does JIRA Server support this too?

If so, can someone provide a curl example?

Jeffrey Lemay_1c4338 · Answer

I guess I don't see what's complicated...  Both Azure DevOps and Jira Cloud allow users to authenticate by replacing their password with thei API token string.  I want to understand if Jira Server supports the same functionality.

I know that there are other ways to authenticate with API tokens.  My preference is to keep our internal Python libraries consistent, and only switch to a different authentication mode for Jira Server if absolutely required.

Radek Dostál · Answer

I honestly don't follow what you are trying to chase here. You seem to be creating a non-existing problem by trying to combine 2 different authentication methods. PAT is not a password substitute, it's the entire header value all by it's own.

Whatever you're trying to solve should be that py library, it should support both basic and PAT.

Jeffrey Lemay_1c4338 · Answer

-H 'Authorization: Bearer <token>'

That header represents Oauth token-based authentication.  I don't know if the other API services we connect to all support Oauth.  But I do know they all support HTTPBasic+token.  Azure DevOps is one of them.  JIRA cloud too.

https://docs.atlassian.com/software/jira/docs/api/REST/8.20.7/

According to that documentation, our version of JIRA server supports Oauth and HTTPBasic.  And I have proven to myself that tokens work with Oauth on our server instance.  I just haven't been able to get tokens to work with HTTPBasic.  I'm trying to figure out if the feature is not supported in Server, if my syntax is wrong, or if HTTPBasic+token needs to be enabled in the server config (which I don't have access to see).