How to perform cookie based authentication in crowd + Jira + SSO using Rest API's

Shan_zjuwjd

Hello Team,

I had done some research and found the below details,

To authenticate the Crowd + Jira environment using cookie based authentication i need to have cookie.token_key & JSEESIONID token.

 My main goal is use the cookies to access Jira which is integrated with crowd using REST calls.

* crowd.token_key  - I could not find any source how to retrieve it using REST api 

* In POSTMAN (Rest client) to login to the crowd server as ex: 

http://serverip:8095/crowd/rest/usermanagement/latest/session?validate-password=true

with POST body username.... pwd ... in JSON format.. 

Jira app name & pwd using basic authentication if we provide then it works.

If I do as above it returns the JSESSIONID token but I could not retrieve the crowd token.

I am not sure the above way is proper or not.

I have few questions.

* How to retrieve crowd.token_key and its value using REST APi's

* How to get the JSESSIONID token 

* How to pass these session tokens to retrieve any datas from jira server. Ex: issues , users ... 

 NOTE: Please do not post the way using crowd libraries. like CrowdClient API's

Thanks in advance.

 

Bruno Vincent

Hi @Shan

You don't need to request Crowd to get a crowd.token_key cookie. A simple request to Jira is enough. This is a better approach as you won't need to expose jira's application name and password.

Here is the workflow:

1. Request the login URL of Jira (with username and password in basic authentication).

You will get a crowd.token_key cookie, a JSESSIONID cookie and an atlassian.xsrf.token cookie.

For instance:

curl -X GET -u "username:password" --silent --output /dev/null -c - 'http://jira.company.com:8080/login.jsp'

Will return:

# Netscape HTTP Cookie File
# https://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

#HttpOnly_jira.company.com    FALSE    /    FALSE    0    JSESSIONID    ABC*****************************
#HttpOnly_jira.company.com    FALSE    /    FALSE    0    crowd.token_key"123*****************************"
jira.company.com    FALSE    /    FALSE    0    atlassian.xsrf.token    XYZ*****************************

2. Now, send whatever request you want to Jira by adding all 3 cookies.

For instance:

curl -X GET -H "Accept: application/json" -b "JSESSIONID=ABC*****************************;crowd.token_key=123*****************************;atlassian.xsrf.token=XYZ*****************************" 'http://jira.cleito.com:8080/rest/api/2/myself'

Will return your user profile in JSON format.