OAuth Authentication From an Add-On to JIRA Rest API

[Kevin Poole]

I swear the docs are intended to just link you around in circles until you give up...

After much searching, I can not find an answer to this.

I have an add-on (written in python, using the django framework) that I would like to be able to make calls to the REST API from. It seems that I will want to use OAuth to do this (I would use JWT and the atlassian connect framework, but the JIRA instance is a server instance not atlassian cloud). When I go to the administrative add-on tools, and click "Application Links" I am forced to provide a link to my add-on. I provide this link, but it fails even though I can successfully go there in a web browser. One of the docs even says that you can provide a placeholder link if you don't have the real one, but providing something like "http://www.google.com" also fails.

Bottomline: the steps to set up OAuth first require that you set up an application link. I am unable to successfully complete this first step, and furthermore, the specific documentation related to "Application Links" seems to indicate that application links can only be created between instances of Atlassian products. Well what if you want to OAuth authenticate a non-atlassian product (aka an add-on)?

image2015-2-25 15:5:19.png

[Alexandr Curtov]

http://oauth.net/core/1.0/#signing_process http://stackoverflow.com/questions/9986533/what-does-oauth-signature-sign

[ccfirst cclast]

This is exactly what I've been trying for weeks now! Is there a solution to this problem yet?

[anand_e]

Same Here.. Banging my head with the docs provided by atlassian which circles around. Though i need to be a cryptographic expert to configure OAuth in JIRA. Somehow i found the halfway. I started to create an Applicationlink. Application URL: https://www.google.com Application Name : Google Application Type : Generic Service Provider Name : Google Consumer key : lInXLgx6HbF9FFq1ZQN8iSEnhzO3JVuf Shared secret : 6kvwVhDGUQGXFawmulAhvORRV8HpZy5OMqMVH7xqwkLcvTbo Request Token URL : https://xxxx.atlassian.net/plugins/servlet/oauth/request-token Access token URL : https://xxxx.atlassian.net/plugins/servlet/oauth/authorize Authorize URL : https://xxxx.atlassian.net/plugins/servlet/oauth/access-token create incoming link : yes (checked) Then it asks for consumer key and name and the public key: public key: -----BEGIN PUBLIC KEY----- MIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgGi4DTqfuEjHCNdw7Yc94ZXF4pGws+Sq7ti4pgOHD6W3C52NLChaLJY1w4H3W8rqTnB/Rh10tR7d1yLYsSmZ1H+D1I7wPNLvIYe20MCqg4KPyEReojFDp0IEGEg/7KTRICDEifgoG29b00BC7I8+kCzf65rDMnukfn8yF952k2/HAgMBAAE= -----END PUBLIC KEY----- It shows that the link is configured successfully. Then I tries to get the request token by a POST request via POSTMAN client. https://anand1886.atlassian.net/plugins/servlet/oauth/request-token? oauth_consumer_key=lInXLgx6HbF9FFq1ZQN8iSEnhzO3JVuf& oauth_signature_method=RSA-SHA1& oauth_nonce=fC9yky& oauth_version=1.0& oauth_signature=6kvwVhDGUQGXFawmulAhvORRV8HpZy5OMqMVH7xqwkLcvTbo&oauth_timestamp=1426834901& oauth_callback=https://www.google.com And I got the following response: " Sorry, we had some technical problems during your last operation. Request assistance Copy the content below and paste it into the details section on this JIRA Administrator contact form Technical details Cause Referer URL: Unknown net.oauth.OAuthException: java.security.SignatureException: Signature length not correct: got 159 but was expecting 128 Return to the previous page " Dont Know what might be wrong and how to contact the support. And I dont know how come this product is widely used. <BANGED>

[Benjamin Lebois]

@Kevin Poole I just did! I thought I did not had enough points.

[Kevin Poole]

@Benjamin Lebois could you possibly upvote this question so that we can try to get someone from atlassian to look into this?

[Benjamin Lebois]

I'm having the exact same problem and did the exact same thinking as you. I managed to make the Basic Authentication works in my C# application. The turorial for this is here : https://developer.atlassian.com/jiradev/api-reference/jira-rest-apis/jira-rest-api-tutorials/jira-rest-api-example-basic-authentication. But like you I would prefer to use OAuth for better security.