Projects are not being returned by a REST API call to createmeta

[Simon Cast]

A client has setup an application link for JIRA 5.2.7 and they have adminstrator privileges. When the a call is made to createmeta no projects are returned. The request body returns

array(

'expand' => 'projects',

'projects' => array(),

)

Call is:

$this->client->setUri($this->host.'rest/api/latest/issue/createmeta');
$this->client->setHeaders('Content-Type: application/json');
$this->client->setMethod(Zend_Http_Client::GET);
$this->client->setConfig(array('timeout'=>300,'adapter'=>'Zend_Http_Client_Adapter_Curl'));

where $this->host is the host of the JIRA server. Note: this works for all other JIRA downloads and on-demand servers of other clients.

However, the client sent me a screenshot showing the projects that the user has access to.

I've not run across this problem with JIRA 6.0. What are the possible reasons that this could be happening?

<input id="mac_address" type="hidden" value=""/>

<input id="mac_address" type="hidden" value=""/>

[Simon Cast · Accepted solution]

By serendipity I found the answer.

In order for the projects to show in the API return, the user needs to have the permission "Browse Projects" and the "Create Issues" permission set for each of the projects they should have access to. Being an administrator of a project doesn't automatically grant that permission instead it is often inherited from another role e.g. "Users".

But wait that is not all! Jira 5.2 comes with a wonderful undocumented bug/feature when doing oauth just for fun! Jira 5.2 requires the use of query parameters for the oauth parameters instead of using POST parameters (which 6+ accepts).

This is componded in that /createmeta API call returns a 200 and empty array of projects when a user is not authenticated instead of a much, much more sensible 401 status code.

Additionally, I think there may be other problems with the JIRA oauth implementation in 5.2 since it seemed to allow the continuation of the oauth flow despite the requesting of the token failing (i.e. both a request token and access token was received even though they never worked).

[Simon Cast]

I've added the rest call to the original question.

<input id="mac_address" type="hidden" value=""/>

[Boris Georgiev _Appfire_]

Please provide the complete REST call.