Can we require users of an Issue Collector form to be authenticated?

dave.drexler

Hi folks - we'd like to use an Issue Collector to allow Salesforce users in our company to file a Jira issue while they're filing a Salesforce customer encounter. The Salesforce users may or may not also have accounts in Jira. The Salesforce users will be logged into Salesforce, but may or may not be also logged into Jira.

Our IT group is concerned that the Issue Collector code could in some way prove to be a vulnerability; that bad actors could somehow use the collector code to get into Jira. And they've asked whether we can force a user of an Issue Collector dialog to authenticate themselves against our Active Directory so that if the Issue Collector were somehow launched outside of Salesforce it wouldn't work.

Any advice? Has anyone else faced this concern?

Brant Schroeder

@dave.drexler There is no way to make it so that the issue collector requires a user to log in to use it.  If you place it on a website that requires authentication then it will be hard for a bad actor to find the code.  The only thing it would allow them to do is to submit an issue through the API to Jira that is all the code is doing.