Authenticating Fisheye REST API without Crucible

[Michael House]

I'm trying to run a few the Fisheye REST API calls in a C# application. I can use the links when I'm already logged into the browser, so I know the REST API calls are correct. However, I'm unable to get authentication working in the C# app.

I've tried adding an "Authorization" header to the request when creating a HttpWebRequest:

request.Headers.Add("AUTHORIZATION", "Basic " + Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(username + ":" + password)));

And I've tried using the built int `HttpWebRequest.Credentials. Additionally I tried using the following url to get a login token:

/rest-service/auth-v1/login?userName=user&password=pass

Which was what I was finding on the web for how to authenticate Fisheye. However, this link only works when Crucible is also active. And a `rest-service-fe` version of the request doesn't exist. The documentation for the Fisheye REST API has nothing of use for authenticating requests.

I'm trying to access the user information referenced in this question and answer: https://answers.atlassian.com/questions/290494/get-a-list-of-repositories-a-user-has-access-to

What is the proper way to authorize an application to use the Fisheye REST API?

[Nick]

This is a bug in FishEye. I have created https://jira.atlassian.com/browse/FE-5206to have this fixed.

In the meantime, you can obtain an evaluation license of Crucible to retrieve the auth token.

Sorry for this inconvenience. A fix should be coming in the next release.

[Michael House]

Thanks for following up on this Nick.

[lpater]

Hi Micheal,

in addition to the issue Nick raised to make the auth resource available for users without a Crucible license, you should be able to authenticate using basic auth as well.

You seem to have tried it in the first snippet - that should work. Try making the case of the header 'Authorization' instead of 'AUTHORIZATION'. If that fails as well try enabling debug logs in FishEye to see if there's an error reported.

Please see https://developer.atlassian.com/display/FECRUDEV/Authenticating+REST+Requestsand https://developer.atlassian.com/display/FECRUDEV/Writing+a+REST+Client+in+Perlfor more details and examples. Be sure to make your requests over https if using basic authentication, to prevent the username and password from being transmitted unencrypted.

[Michael House]

Hey Lukasz, I assume you intended to write 'Authorization', and not 'Authentication'? Either way, I tried both. Neither work. Additionally I tried enabling logging and there were no errors or even debug logs associated with the attempted login. It's not even that nothing is working. I'm just trying to get a list of repos using 'rest-service-fe/repositories-v1'. When I try this in the browser I'm logged into I get a list of repos. When I try it with the application, I get an empty list of repos '<repositoryList />'.

[Phil Schuppert]

I'm not able to get basic authentication to work.  I can make curl calls work by passing in username and password directly, such as : 

$ curl -X PUT -H "Content-type: application/json" -u "uname:pword" "https://server.myserver.edu/fisheye/rest-service-fecru/admin/repositories/testingauth/stop" -k

This successfully issues the command, but when I run 

$ curl -X PUT -H "Content-type: application/json" -H "Authorization: Basic insertBase64EncodedUsernameandPasswordHere" "https://server.myserver.edu/fisheye/rest-service-fecru/admin/repositories/testingauth/stop" -k

I get a 401 error saying the username and/or password are invalid