Is it possible to restrict non-admin users from connecting marketplace apps?

[Elizabeth Oxton]

Hey Everyone!,

Just curious if anyone might be able to confirm: is it currently not possible to prevent team members from connecting to apps in the marketplace? We recently had a team member connect to a free app (largely harmless) but doing so authenticated for that app to have a lot of read-scope over a lot of data. This was able to be connected and installed through the marketplace without an admins approval. Can this be prevented?

This happened in our Jira (cloud) instance.

It looks like this confluence article (https://confluence.atlassian.com/upm/configuring-marketplace-connectivity-306350947.html) hints that maybe by disabling the UPM (turning the UPM to offline mode) would disable the marketplace.

Can this also be done for Jira or only Confluence?
Does disabling the UPM disable already installed apps or only updates and new installations?

Any insight would be appreciated! Thankfully we can just disable this app and alls likely fine. But we'd like to control who has the ability to install apps going forward...

[Rachit Singhal · Accepted solution]

Hi @Elizabeth Oxton ,

I think you are talking about the connected apps.

If yes, here is the solution of your problem. Login into your Jira having Org admin permission. Navigate to User Management and go to Products then go to "Connected apps" under Site Settings, there you will find the apps installed by user. You can uninstall the apps that you want by managing each app and to prevent this in future, you can go to settings and "Block user apps" permission.

Please let me know if you sill face any issue.

Thanks,

Rachit Singhal

[Elizabeth Oxton]

Hey Rachit! At the original time of this post there was no "Block user apps" option in the settings. But it was added a few weeks/months after. You're totally right and this is the correct solution for anyone looking in the future! Forgot to come back and edit this post, thanks for posting the solution for everyone :) 

[Rachit Singhal]

Thank you Elizabeth for bringing more clarity on it. 

[Jack Brickey]

Users in the Basic role cannot add apps. Users with Trusted or Administration roles can. This is managed under User Management admin.

[Elizabeth Oxton]

Hey Jack!,
Thanks so much for responding.

This user is in the basic role. :(

I reviewed our audit log as well and there's been no updates to their permissions since the license activated -- like they were never put in a group that had product administrative access or anything.

Is there some other permission setting that might override that basic role and allow someone to install from the marketplace by themselves?

OR if its written down anywhere in the help docs that the permissions should be restricted for the basic role, that would be really helpful to see too!

[Jack Brickey]

Not that I'm aware of. It would be interesting to see if that user with basic access can in fact add another app.

[Elizabeth Oxton]

Hey Jack! Hope your weekend was well.

Just wanted to let you know our admin team was able to connect with this user and do a little more investigation. The marketplace restriction works as intended with the Basic role preventing installations. (Thank you!)

The question as phrased is probably a 'solved' so this might be better suited to a new thread (not sure of the forum standard here), but it appears the issue is actually (or at least potentially) related to the OAuth 3LO option: https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/

User went to app that offers an oauth connection to Jira. App uses their token to access the data. App installs in the jira instance without an admins approval but only that user has access. Possible to revoke their token or to uninstall the app completely.

How can these apps be prevented from being installed? Are there any system level settings that can block users from okaying oauth tokens for the jira instance, etc.?

[Athas Mark]

For my own sense of this:  a Team-Managed or Company-Managed Project Administrator cannot install add-on's.  Is this correct?

[Elizabeth Oxton]

Hey Mark!,

What Jack was referring to is this setting in the user administration. The "basic" role is not tied to the project but rather the users' whole login to the site.



To prevent a user from installing an app from the app marketplace you just need to make sure they have the basic role. So a company-managed project admin may still only be a 'basic' user on your jira instance; and so they will not be able to install a marketplace app.


Unfortunately there's other ways that apps can get installed through 0Auth on user login tokens, and this is seemingly not able to be restricted no matter what permissions are given to the user (in a project or in the user administration settings).

[Jack Brickey]

Correct…

[Athas Mark]

Thanks for the Clarification Oliver !