Access issue collector from WAN to JIRA inside LAN

Jira instance is internal LAN. So the only access to it currently is via VPN from outside.

We want to keep it this way.

However we want to be able to allow people to submit JIRA tickets without having to VPN in.

Issue collector seems like a good option.

I have a websever set up on the same network in the LAN. The webserver is acessible via the WAN. So I have a basic html page with the issue collector pasted inside. However the issue collector does not load when that page is acessed externally. Internally it does obviously. But extrnally just the basic html page.

Anyone have any idea how to make this work?

The Java script is specifically looking for the internal hostname to Jira which obviously outside people wouldnt have access to, however the webserver does and people have access to the webserver so there has to be a way to display the issue collector through the separate webserver right?

Any thoughts?

2 answers

1 accepted

1 vote
Accepted answer

Without a copy of that code, it is very difficult to say what went wrong. Most probably your javascripts (that execute in the user's browser) are trying to contact something thinking it's located in the user's LAN (if the private ip range matches) or something like that.

Private IP addresses are not valid for internet, only for intranets. For the internet, you need to use public IP addresses (globally unique).

If you need a javascript that accesses your internal JIRA server, you need to make that server/service available from the user's point (which you don't want). So, the solution is to provide WAN users with a custom java servlet (or php page) that will serve as a kind of a proxy between your JIRA and WAN users.

One of the cool solutions would be to create a simple page to immitate JIRA issue submission page, where your WAN users can provide all the details and then create a REST call, from your webserver directly to the JIRA (not from the javascript that runs in the user's browser). That way your webserver can authenticate to the JIRA even using basic authentication, since no WAN users can see that traffic between webserver and JIRA server.

Hey Mladen,

Thanks for the reply.

I understood all of what you said before you posted. I can post the code of website but literally its just a basic page with a background. Then the copy and paste of the JIRA js code.

It IS in fact trying to reach an internal ipaddress, first because the code that jira gives to paste into the webpage begins with the link to JIRA's location(in this case, internal LAN) 10.x.x.x.

I know outside world won't have access.... I naively thought that placing that javascript paste from JIRA into a webserver that CAN be accessed through the WAN from anywhere in the world would work since the webserver IS on the same LAN as the Jira install. (two seperate boxes though).

How difficult is it to make a PHP page that does what you suggest, acts as a proxy to collect the information and then submit it to Jira.

Your second solution sounds cooler indeed but I'm not much of a coder so I wouldn't know enoguht to make it work right. Any links or suggestions to get me on the right track? I can build a very basic submit form to email in php, but thats about it.

-Will

I naively thought that placing that javascript paste from JIRA into a webserver that CAN be accessed through the WAN from anywhere in the world would work since the webserver IS on the same LAN as the Jira install.

Your assumption is correct, but you forgot that javascripts are executing in the user's browser and not on the web server :) For this reason you need something executing on the web server, which can have access to your JIRA server.

The solution is actually pretty simple. You need a simple web page (php, java servlet, cgi script, whatever you find the easiest to implement) which will simply collect the user input (submitted form) and execute the curl application to perform the REST call to the JIRA. Collection user input through submitted forms is a trivial thing for any kind of web scripts and performing curl REST call is even more trivial. Let's say you decide to go with php. Your code would look like this:

<?php

	// Collect the user input, submitted through the form.
	$summary = $_REQUEST('summary');
	$issue_type = $_REQUEST('issue_type');
	$assignee = $_REQUEST('assignee');
	...

	// Take a look at: https://docs.atlassian.com/jira/REST/latest/
	// and search for 'curl' to see how to call curl application
	// with the correct parameters.
	// Also, look at the issue submitting REST call:
	// https://docs.atlassian.com/jira/REST/latest/#idp1846544

	// now, perform the REST call
	shell_exec('curl -D- -u admin:admin -X POST -H "X-Atlassian-Token: nocheck" -H "Content-Type: application/json" -F "file=@myfile.json" http://myhost/rest/api/2/issue');

	// you don't need to use the file "myfile.json", you can directly
	// provide your form data but it's a bit clumsy that way

	$json_data = '{ "update": ... }';
	shell_exec('curl -D- -u admin:admin -X POST -H "X-Atlassian-Token: nocheck" -H "Content-Type: application/json" --data \'' . $json_data . '\' http://myhost/rest/api/2/issue');

?>

and that's it :)

I have a bunch of custom fields in my collector... how do I know the names to use

do I need to see what the collector is calling each field? I cant see the specific collector source...

fyi .. heres an example of some of the fields in the collector

The best way would be that you use Atlassian SDK and create a simple JIRA plugin and add a REST module to the plugin. This way, you would have 1 single REST request from your php script (a simple http get request) and after you get the json reply, you would parse it into the php object using json_decode() and after that you have all the fields you need to populate your html page for WAN users.

Once the WAN user clicks a submit button, your php page would perform the 2nd REST call (a simple http post request) and would create the issue in JIRA that way.

Is it too much for you to do all that? If you need any help, let me know how can I help you with that.

P.S.

I just checked with the JIRA REST API. You don't have to write your own REST module for JIRA, but you still need to write your php page. This is because JIRA already has got the needed REST service to provide all the fields for the Create Issue step and the rest service is: /rest/api/2/issue/createmeta

This way, you only need to create 2 REST calls in your php script (one to read all the fields for the creation of a new issue and one to store the new issue, once the user provides all the fields).

What you said makes perfect sense.

Basically scrape the page for the api names or webnames and then use those in the post request to submit the standard field entries(WAN) into the jira form fields(LAN) >submit.

SO that does basically answer my question and its a great way to do it.
The logic is pretty clear. I wouldn't know how to write out the syntax to make that all happen in a timely manner. I'll review the links you sent I didnt know theres was a beginner tutorial on making plugins. But it will probably be some time before I can get THIS to function.

If you're feeling generous and want to assist in depth I'd very much appreciate it. Feel free to help here or email me at will@thankstips.com

But you've definitely nailed the solution here. So thanksa lot. The logic is a lot clearer now.

I'll try to provide some example code which should give you a clue how to do it in your particular case and even extend it. Just give me some time to collect all the needed things and I'll reply here with the code.

Ok thanks!

I'm also testing apache proxy functions.

I have my landing page loading for the most part.

I added a folder in the jira home folder. So people can access that folder. The issue with this is the Issue Collectors only run from the jira home folder... and in proxying to that folder direct it works from the WAN but then obviously uou can jsut go to the root and see the internal Jira login page.

Can I move the issue collectors to a different location and run them that way instead?

I'd still prefer my own custom forms to the proxy method... proxy still seems less safe

fyi .. here are the fields in the collector

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Nov 29, 2018 in Jira

How to set up an incident workflow from the VP of Engineering at Sentry

Hey Atlassian community, I help lead engineering at Sentry, an open-source error-tracking and monitoring tool that integrates with Jira. We started using Jira Software Cloud internally last year, a...

1,119 views 0 8
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you