Jira REST API authentication from Salesforce Named Credential

[Nicholas_Rampton]

Hello, all--this is a first post, so if anything in my approach is amiss, apologies in advance!

Context: I've been setting up a Salesforce-based help desk to track incoming customer support issues. Case managers use the Salesforce system to log all the calls and emails they get, and anything they believe needs to go to the dev team, they need to log the case in our Jira server.

So we've set up a custom button that packages the necessary fields in JSON and sends them to the Jira REST API (v2), which creates the issue on our in-house Jira server (v.7.13). For authentication on that request we're using Salesforce's Named Credentials feature, which stores each user's Jira credentials in Salesforce and handles setting authentication headers for each API request (using the Basic authentication scheme).

The trouble: For roughly half of our case managers the Jira server refuses to authenticate. So issues aren't getting created. Half of them get through just fine, the Jira issue gets created and assigned and all that good stuff. The other half get a "401 - Unauthorized" error.

So far: Checking Salesforce logs shows the URL being correctly interpolated and the Basic authentication hash set up correctly. We've had the affected users double and triple check that their individual credentials are stored correctly in Salesforce. Running the same requests through CURL in the command line and Postman do not produce the same problems, so a credential problem seems unlikely anyway. I've done my best to make sure there are no differences between the Salesforce configurations of affected and non-affected users.

We've been looking into Jira logs as well. The error message reported there is

<user> tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.

But again, as far as we can tell the affected users all belong to the same Jira permission groups as the unaffected users.

At the suggestion of Jira tech support we've also made sure to whitelist the relevant Salesforce domains on our Jira server, but that wasn't helpful. In some way this has to be user-specific.

So we're still going back and forth with Jira support, but in the meantime they suggested that I see whether anyone here has more specific experience. I'm sure I've missed reporting some crucial details here, so feel free to point out the obvious. I appreciate any help in advance!