Invoke-WebRequest API error 401 (Unauthorized)

[Christian Thurow]

Dear community, 

I'm having trouble connecting to my companies Jira server using a powershell script and the Invoke-WebRequest commandlet.

I'm using the following script. Note that I'm getting the same error with any valid URI to this Jira server. While the same user can access all these URI's through a webbrowser just fine.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

$baseUrl = "https://MyDomain.atlassian.net"
$jql = "%22Epic Link%22 = SD-2"

$user = 'USER@MyDomain.com'
$pass = 'TheCorrectPassword'

$pair = "$($user):$($pass)"

$encodedCreds = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($pair))

$basicAuthValue = "Basic $encodedCreds"

$authHeader = @{
Authorization = $basicAuthValue
}

Invoke-WebRequest -uri $($baseUrl + "/rest/api/latest/search?jql=$jql") -Headers $authHeader -UseBasicParsing -ErrorAction Stop -Verbose

Output from powershell:

Invoke-WebRequest : The remote server returned an error: (401) Unauthorized.
At D:\Work\JiraAccess2.ps1:22 char:1
+ Invoke-WebRequest -uri $($baseUrl + "/rest/api/latest/search?jql=$jql ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
eption
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Could there be a setting on the Jira Server that prevents this user from connecting via "Invoke-WebRequest"? Or is something wrong with my script?

Edit: I'm using the cloud version.

[Andy Heinzer · Accepted solution]

Hi Christian,

I see that you're using powershell in order to try to connect to the Jira Cloud REST API, but that you're getting a 401 authorization error.  Thanks for posting your code here, I think I see the problem.

The way you're converting the password appears to be calling the ASCII encoding of the text.  However we're actually expecting UTF-8 to be used here when converting.  We have a sample of this for powershell over in Basic auth for REST APIs.

$Text = ‘user@example.com:api_token_string’
$Bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
$EncodedText = [Convert]::ToBase64String($Bytes)
$EncodedText

I'm betting that using the ASCII encoding here is actually generating a different character string when encoded into base64.  In turn your encoded credentials are incorrect here and Jira is throwing a 401 error.  Try using this example as a base and see if you have any better success here. 

Let me know the results.

Andy

[Christian Thurow]

Thank you very much Andy. Using the api token instead of the password and using UTF-8 fixes my problem.

In case it helps someone else in the future, this is the script that works for me now:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

$baseUrl = "https://MYDOMAIN.atlassian.net"
$jql = "%22Epic Link%22 = SD-2"

$user = 'USER@MYDOMAIN.com'
$token = 'myToken'

$pair = "$($user):$($token)"

$encodedCreds = [System.Text.Encoding]::UTF8.GetBytes($pair)

$encodedBase64 = [System.Convert]::ToBase64String($encodedCreds)

$basicAuthValue = "Basic $encodedBase64"

$authHeader = @{
Authorization = $basicAuthValue
}

Invoke-WebRequest -uri $($baseUrl + "/rest/api/latest/search?jql=$jql") -Headers $authHeader -ErrorAction Stop -Verbose

[Andy Heinzer]

Thanks for posting back with your code.  Feel free to accept my answer if it solves your problem here.  This can help others to easily see the solution that might have the same problem in the future.

You're also welcome to post your solution as an Answer to this question, instead of a reply.  That way you can also accept your own answer too.

Cheers,

Andy

[Marcus Brown]

Hi All,

I have a similar situation but I'm trying to use the ConfluencePS PowerShell module. I tried your example above using the REST API and I was successful in logging in and executing a query.

I'm unsure how to implement this method using the Set-ConfluenceInfo command as shown here: Set-Info - Docs | AtlassianPS.

I have tried to use a similar method as detailed here to create a credential object but I'm still unable to run Get-ConfluenceSpace without the error Christian mentioned in the original post.

Any help would be greatly appreciated.

I should also mention that I was successful in connecting using my generated token and I would like to use my username/password with the PowerShell module.

[Eric Prescott Test]

Hey Marcus! Did you ever sort this for the confluencePS module? I have been having the same issue. This does work on our on prem confluence, but not cloud. I have not been able to figure out why, unfortunately

[Mattias Vannergård]

I have exactly the same situation. It works with ConfluencePS on the on prem Confluence, but not on the Cloud instance. Any solution to this yet?