403 - Forbidden when attempting to connect Bamboo to JIRA as a User Server

Still need help?

The Atlassian Community is here for you.

Ask the community

Problem

Attempting to connect to Jira as a user repository (using Jira's User Server function) fails with the following message in the UI – the password is correct:

Failed to change the active user repository: com.atlassian.crowd.exception.ApplicationPermissionException: Forbidden (403) Encountered a "403 - Forbidden" error while loading this page. Go to JIRA home

The following appears in the atlassian-bamboo.log

2016-07-20 14:15:39,010 ERROR [http-apr-8085-exec-23] [DefaultUserAccessor] Error in getUser():com.atlassian.crowd.exception.ApplicationPermissionException: Forbidden (403) Encountered a "403 - Forbidden" error while loading this page. Go to JIRA home
com.atlassian.user.EntityException: com.atlassian.crowd.exception.ApplicationPermissionException: Forbidden (403) Encountered a "403 - Forbidden" error while loading this page. Go to JIRA home
	at com.atlassian.crowd.integration.atlassianuser.UserGroupCache.fetchAndSetSnapshot(UserGroupCache.java:110)
	at com.atlassian.crowd.integration.atlassianuser.UserGroupCache.get(UserGroupCache.java:143)
	at com.atlassian.crowd.integration.atlassianuser.CrowdUserManager.getUser(CrowdUserManager.java:29)
	at com.atlassian.user.impl.delegation.DelegatingUserManager.getUser(DelegatingUserManager.java:73)
	...
Caused by: com.atlassian.crowd.exception.ApplicationPermissionException: Forbidden (403) Encountered a "403 - Forbidden" error while loading this page. Go to JIRA home

	... 240 more

Cause

The following are possibilities:

  1. JIRA does not include Bamboo server IP address in JIRA User Server settings or has not whitelisted "localhost" if both applications are installed on the same server.
  2. The IP address of to the incoming request from Bamboo to Jira is the address of the load balancer / reverse proxy in-front of Jira that is forwarding the request, not the IP Address of the Bamboo Server.
  3. There is a proxy or firewall that blocks such access from Bamboo to Jira.

Resolution

  1. Ensure that Bamboo server URL (or IP address) has been added to JIRA User Server connector or whitelist.
  2. Ensure that the IP Address of the load balancer or reverse proxy in-front of JIRA has also been whitelisted against the Bamboo application defined at Jira Administration >> User Management >> JIRA User Server >> Edit 
  3. Configure any proxy or firewall (rules blocking the access, NAT or PAT etc.) that might block such access. You might want to follow this method Configuring Web Proxy Support for Confluence or review the rules in your firewall or even the logs to see if these packages are being dropped. Try bypassing the proxy. For instance, if both JIRA and Bamboo are on the same server, use 127.0.0.1 to connect. From Connecting to JIRA for User Management:
    1. "Go to your Jira administration screen and define the Bamboo application to Jira", item 5, configure the following IPs:

      127.0.0.1
      ::1
      your.hostname
    2. "Set up the Jira user directory in Bamboo", item 4, configure http://127.0.0.1:port/context_path on the "Server URL" settings.

    3. Alternatively, use the IPs of Bamboo and Jira if they have a direct connection to each other through the network.

Use the instructions in the resolution of the following KB if updating the IP address in Jira fails to work:

Bamboo lost connection to the external user directory preventing users from logging in



Last modified on Oct 15, 2019

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.