Issue with JIRA & Slack Integration

[taylor.smith]

After successfully connecting my Slack account with JIRA server, I attempt to confirm access to my Slack Account by clicking on the link provided, however when I do I receive the following error message:

OAuth Error: redirect_uri did not match any configured URIs.

Passed URI : https://jira.ec2.local/slack/oauth/redirect/XXXXXX

 Is this a known issue, and if so, is there a solution/current workaround?

Thank you!

[Luiz Silva · Accepted solution]

Hi, Taylor.

So, this error comes from Slack during the authentication flow. It means your Jira base URL is not properly setup in Slack's configuration so it complains about it.

If you look into the docs, there's a configuration step where you need to manually input your Jira base URL into Slack's configuration:

If you haven't filled that up and submitted successfully, you would still be able to use those credentials to get Jira notifications into Slack, but not the other way around, i.e., Slack wouldn't be able to talk to Jira.

You'll also be constrained by the fact that Slack performs a check on your Jira URL, therefore it must be publicly available on the internet and secured with HTTPS.

It means, first, you'd need to make sure your firewall allows traffic from the internet to your Jira through a valid domain.

Also, self-signed SSL certificates are not accepted. If you don't have a valid signed certificated, you can obtain one for free at https://letsencrypt.org/.

[sidarthvadewr]

Hi Luiz, where do we find the JIRA firewall settings to allow traffic to the JIRA instance? I am having the same OAuth Issue.

[Luiz Silva]

Hey @sidarthvadewr

Sorry for the delay. Somehow I missed the notification about this comment.

You can find more information about whitelisting requests here: https://confluence.atlassian.com/adminjiraserver073/configuring-the-whitelist-861254007.html

If you have more questions, please reach out to our support.

Cheers!

[Daniel Swiatek]

I tried to enter the URL of my Instance, but ive got always an error. 

[Luiz Silva]

Hi, @Daniel Swiatek

In order for this to work, your instance should...

• have the official plugin installed in its latest version;
• be reachable by Slack over the internet, which basically means you have to open your firewalls accordingly;
• be secured with a valid certificate under the HTTPS protocol; and
• whitelist requests to <baseUrl>/slack* in any Jira plugin that blocks external or unauthenticated requests.

If none of that works you might have to contact Slack for a possible issue with your App configuration or the Atlassian support if you still have trouble making the connection.

[Jackson_Chan]

<deleted>

[Jackson_Chan]

https://confluence.atlassian.com/slack/using-jira-applications-with-slack-966662163.html

I followed the section "I use multiple Jira Server instances. How do I connect them to Slack?" to create a new app and add my jira server info and enter

https://jira.ec2.local/slack/oauth/redirect/XXXXXX

as redirect url and then it works. Not sure why. 

[Luiz Silva]

Hi @Jackson_Chan

Thank you for reporting this. If I understood correctly you had the issue fixed yourself. If that's true, I'm glad for that.

The Slack's OAuth redirect URL should allow subpaths. So, for instance, adding https://jira.ec2.local/slack/oauth in your configuration should match https://jira.ec2.local/slack/oauth/redirect/XXXXXX. I myself have multiple apps working that way.

If that's not working, you may want to ask Slack to understand why.

[Jackson_Chan]

I still cant get the vanilla app to work. I had to getaround it by creating a new app.

Also while doing that, for some reason the subpath that you mentioned doesnt work and I had to manually specify the /redirect/XXXXX.

perhaps whatever causing this issue also caused the vanilla app not working? 

MORE Background info: I had just migrated from Jira Cloud to Jira Server, not sure if it is also causing problem.

Is this a slack issue or atlassian issue then? 

[Luiz Silva]

There's actually an issue with our main "vanilla" Slack App that depends on a fix by Slack. We've contacted them and hopefully we'll have a solution soon enough.

Though more cumbersome to setup, creating a new app of your own gives you even superior flexibility over the one that's pre-configured. For instance, the vanilla App does not support domain unfurling while the you one created does, if following all the procedures correctly.

That's to say you don't have to worry about rolling back to the vanilla app now.

[Jackson_Chan]

While I followed the instruction in the link I included in my previous message to create a working new app for Jira, I have problem doing this for Confluence.

Do you possibly have/know of instruction to do the same (create new app)  for Confluence? 

[Luiz Silva]

@Jackson_Chan

Documentation for all Server Apps for Slack can be found here.

The main difference is that Jira one's got pretty URLs so, for instance, while for Jira you use <url>/slack/event, for Bitbucket and Confluence Server uses <url>/rest/slack/latest/event.

Be aware, though, there are other minor differences in the Apps' configuration due to their different capabilities.

[Daniel Swiatek]

@Luiz Silva i whitelist url/slack* under Whitelist and deactivate my TwoFactor Plugin. But if i tried to enter my url on Slack App Page i´ve got an error that only says "Something went wrong" (in German)

[Luiz Silva]

Hey @Daniel Swiatek,

It's hard to tell what exactly might be wrong without more details.

What I can emphasize, though, is the integration's endpoint should be reachable by Slack. As a general rule you should check:

• Your instance is available form the internet via a secure HTTPS connection with a valid certificate (not self-signed).
• You don't have a plugin blocking such requests. You've either disabled them or whitelisted necessary paths.
• The URL typed in Slack is the exact instance base URL, without trailing slash and with the context if any.

Examples of valid and invalid base URLs as you enter them in the Slack configuration:

# valid
https://my-jira.com
https://super-jira.company.net
https://super-jira.company.net/jira

# invalid
http://my-jira.com # not HTTPS
https://super-jira.company.net/ # trailing slash

Checking the integration further 

If you would like to test the integration, you can make a request to the verification event endpoint. In a bash terminal it looks like this:

curl -X POST \
  https://<jira-base-url>/slack/event \
  -H 'Content-Type: application/json' \
  -H "X-Slack-Request-Timestamp: $(date +%s)" \
  -H 'X-Slack-Signature: any-value' \
  -d '{"challenge": "boo","type": "url_verification"}'

It should respond with boo. Make sure this request 

An administrator can raise the log level of com.atlassian.plugins.slack to DEBUG. Now the logs will contain information about incoming Slack requests and responses.

Check the Slack app further

The "Oops" error when submitting your instance URL is known to happen sometimes just after one has removed the App from a workspace. This issue tends to fix itself within 15 or so.

Server apps work a bit differently from regular ones. When you install apps for Jira, Confluence, or Bitbucket Server, a clone is made of what's called a Blueprint App. Sometimes this clone gets into an inconsistent state and a re-installation might help.

[Daniel Swiatek]

Hi @Luiz Silva

thanks for help. I remove the App from Slack Workspace and tried again. Now it works for me. 

[Brian Yarab]

It took me a good while to figure this out but in my case I was always getting the "Ooops error" when putting your jira instance URL in.

So even though my site certificate was valid it did not include the whole certificate chain on the load balancers.

Everything worked fine except for this.

As a suggestion you can always double check your cert using https://www.digicert.com/ or some other cert checker.