Skip to end of metadata
Go to start of metadata

Redirection Notice

This page will redirect to OAuth Security for Application Links.

When you create an application link between two applications, OAuth authentication is used by default. This authentication type lets logged-in users take advantage of all the integration points between Atlassian applications.

 

On this page:

The following types are available:

Atlassian only recommends using OAuth authentication for Application Links.

Depending on your permissions when you create an application (or the settings required in the application you are linking to), you might need to modify the authentication settings for an application link after it's been created. There are a few common scenarios in which you might need to change the configuration of an application link:

  • You've set up an application link but users still have to authenticate regularly. This can occur when the application link has been configured to not share the same userbase. If those applications do share the same user base, you can update your application link authentication by selecting the Allow user impersonation through 2-Legged OAuth check box on the incoming authentication settings for the application link configuration.
  • You want to continue using a link to an application that now allows public sign-on and the link was previously configured with a shared userbase. You can update your application link authentication by clearing the Allow user impersonation through 2-Legged OAuth check box on the incoming authentication settings for the application link configuration.
  • You use a plugin that requires a specific authentication type.

Note that to get the full integration available in the Development panel in JIRA Software issues, JIRA Software must be connected with Bitbucket Server, FishEye, Crucible or Bamboo using a 2-way application link that has both 2-legged (2LO) and 3-legged (3LO) authentication enabled. See Integrating with development tools for version information and connection details.

OAuth is the authentication type we recommend. However, be aware of the following security implications:

  • Adding an OAuth consumer requires the transmission of sensitive data. To prevent 'man-in-the-middle' attacks, it is recommended that you use SSL for your applications while configuring OAuth authentication.
  • Do not link to an application using OAuth authentication, unless you trust all code in the application to behave itself at all times. OAuth consumers are a potential security risk to the applications that they are linked to because of the ability to impersonate users. If your server is compromised, the data there and on linked servers is at risk.
  • New application links now use OAuth by default and enable both 3-legged OAuth (3LO) and 2-legged OAuth (2LO).
  • When updating older application links (that perhaps used Trusted Apps authentication) to use OAuth, 3LO is enabled by default, but you need to explicitly enable 2LO using the Allow 2-legged OAuth check box in the application link configuration settings.
  • Only use the 2LO with impersonation option in the application link configuration settings if your servers both have the same set of users and the servers fully trust each other.

We no longer recommend the Trusted Applications authentication type. If you do use Trusted Applications authentication, be aware of the following security implications:

  • Trusted applications are a potential security risk. When you configure Trusted Applications authentication, you are allowing one application to access another as any user. This allows all of the built-in security measures to be bypassed. Do not configure a trusted application unless you know that all code in the application you are trusting will behave itself at all times, and you are sure that the application will maintain the security of its private key.
  • Only use Trusted Applications authentication if both your servers have the same set of users and the servers fully trust each other.

Atlassian's application links provide both OAuth and OAuth with impersonation authentication types:

Non-impersonating authentication allows you to link applications when the applications don't share the same user base.

It always uses a pre-configured user, and not the logged-in user, when making a request. The server handling the request determines the level of access to use based on the access permissions of that pre-configured user, and this is used for requests from all users.

See OAuth security for application links for more information.

Impersonating authentication makes requests on behalf of the user who is currently logged in. People see only the information that they have permission to see. This authentication type should only be used when the two servers share the same user base.

Impersonation provides greater convenience for your users – they don't need to authenticate when they request restricted resources from the remote application. The following restrictions apply:

  • Both applications must be Atlassian applications.
  • Users should have the same user account and use the same password on both applications.

See OAuth security for application links for more information.

  • No labels

0 Comments