Using email/API key, but still receiving "Basic authentication with passwords is deprecated" error

[Alexander Harrison]

Hi Team,

I am in the process of updating our company's basic authentication with user/password to email/API key.

According to this (https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account), I should be able to update the username with an email and the password with an API key and make this request successfully:

curl -v https://<company>.atlassian.net --user <user>@<company>.com:<b64key>

This request fails with this error:

* Server auth using Basic with user '<user>@<company>.com'
> GET / HTTP/1.1
> Host: <company>.atlassian.net
> Authorization: Basic <removed>
> User-Agent: curl/7.64.1
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< Date: Wed, 22 Jun 2022 23:10:14 GMT
< Content-Type: text/plain
< Server: globaledge-envoy
< X-Envoy-Upstream-Service-Time: 1
< Expect-Ct: report-uri="https://web-security-reports.services.atlassian.com/expect-ct-report/atlassian-proxy", max-age=86400
< Strict-Transport-Security: max-age=63072000; preload
< X-Content-Type-Options: nosniff
< X-Xss-Protection: 1; mode=block
< Atl-Traceid: 29224f439162d46d
< Report-To: {"group": "endpoint-1", "max_age": 600, "endpoints": [{"url": "https://dj9s4kmieytgz.cloudfront.net"}], "include_subdomains": true}
< Nel: {"report_to": "endpoint-1", "max_age": 600, "include_subdomains": true, "failure_fraction": 0.001}
< Vary: Accept-Encoding
< Transfer-Encoding: chunked
<
Basic authentication with passwords is deprecated. For more information, see: https://developer.atlassian.com/cloud/confluence/deprecation-notice-basic-auth/
* Connection #0 to host <company>.atlassian.net left intact
* Closing connection 0

What do I need to do to make the example request work?

Thank you!

[Steven F Behnke · Accepted solution]

Things have changed over time. 

In JIRA 6.3 or6.2, Atlassian added a new permission called 'Transition Issues' permission. This is what is being checked now.

You can use the Close permission just like you could in Classic Jira. Add a condition to the Close transition, choose Permission Condition, then select Close Issues permission. 

This will get you the desired output in older and newer versions of JIRA. Effectively you need to apply the conditions to the workflow yourself, JIRA has no concept of a 'close' transition. 

[Mary Peek]

So being able to execute the transition (with the Transition Issues permission) which contains an Issue Closed event in the post function, actually closes the issue. Even though she doesn't have the Close Issues permission in the permission scheme. So the combination of all this trumps the Close Issues permission? I always thought that if you did not have the Close Issues permission then you couldn't close issues. I guess, as is often the case, it depends!

[Steven F Behnke]

The Issue Closed event really only ties a specific notification template to that event. It doesn't indicate to JIRA that the conditon needs to be permission protected. Permissions and Events are not related to each other.

It has always been the case in JIRA that you needed to apply the Permission Condition: Close Issues Permission to the appropriate Transitions.

If you had to have Close Issues permission close issues in the past, that means you were either using the Default JIRA Workflow (which uses these conditions by default) or you had an Admin that used the Permission Conditions on custom workflows.

JIRA does NOT do the work for you. Again, you can name a transition ANYTHING you want. JIRA can't possibly know that a transition named "ajsdkfdsafk" leading to a status named "asfdsijvsaf" needs to be protected by a Close Permission. You must provide this framework by using the existing conditions/permissions on your custom workflow.

[Steven F Behnke]

Before the "Transition Issues" permission, if you didn't use the permission conditions, even logged out users could execute transitions. This was more fragile before the "Transition Issues" permission was released.

[Mary Peek]

Thanks!

[Steven F Behnke]

No problem at all! I love talking JIRA.