Application Links User Guide

Create an application link

For instructions about linking from a particular application, see the relevant page below:

• Link to server apps from Atlassian Cloud apps
• Jira server applications
• Confluence server
• Bamboo server
• Fisheye
• Crucible
• Bitbucket Server

Link Atlassian server and cloud applications

Atlassian server applications can be linked to cloud applications. To create an application link in this case, you must add the domain name of the cloud instance as a rule (that accepts incoming requests) to the server application's whitelist. In order for a cloud application to make use of all the functionality available with application links when linked to a server application, the server application must be accessible to it through port 80 or 443.

Note also that:

• Jira Cloud doesn't allow 2LO with impersonation as noted in the  Restricted Functions in Jira Cloud .
• Jira Cloud 2LO without impersonation is available and required for the Development Panel in Jira issues. See below.

For more information, see Link to server apps from Atlassian Cloud apps.

Configuration notes for application links

• Atlassian no longer recommends the Trusted Applications and Basic authentication types. We only recommend using OAuth authentication for application links, because of the greater security inherent with that protocol. See Configuring authentication for an application link.
• For Atlassian applications that use AppLinks 4.0, or later (see the version matrix), creating a new application link now uses OAuth by default and enables both 3-legged OAuth (3LO) and 2-legged OAuth (2LO).
  • When updating older application links (that perhaps used Trusted Apps authentication) to use OAuth, 3LO is used by default, but you need to explicitly enable 2LO using the check box in the application link configuration settings.
  • Only use the 2LO with impersonation option in the application link configuration settings if your servers both have the same set of users and they fully trust each other. See below.

• When linking to Jira applications, the remote API must be enabled in Jira ( enable the 'Accept remote API calls' parameter in General Configuration).

• If you run an application on port 443, you must use a valid SSL certificate (which is not self-signed) for the functionality available with application links to work fully.

• When using Firefox (version 23 or later) to create an application link from HTTP to HTTPS URLs, Firefox may initially block the connection and issue a warning. You can allow the connection and continue to set up the link.

Impersonating and non-impersonating authentication types

Application links allow you to configure 'impersonating' and 'non-impersonating' authentication types:

• Impersonating authentication makes requests on behalf of the user who is currently logged in. People will see only the information that they have permission to see. This is available for OAuth and Trusted Applications authentication, and should only be used when two applications share the same user base, typically managed with an external directory using LDAP.
• Non-impersonating authentication always uses a pre-configured user, and not the logged-in user, when making a request. The server handling the request determines the level of access to use based on the access permissions of that pre-configured user, and this is used for requests from all users. This is available for Basic HTTP authentication.

Relocate an application link

You may need to update an application link if the remote application has changed to a new address.

A warning is displayed on the 'Configure Application Links' admin page if the remote application cannot be reached:

The warning means that the local application can no longer communicate with the remote application using the URL used to create the application link. This might happen if:

• The remote application can't be reached: you should check your network configuration and ensure that your remote application is running.
• The remote application has changed to a new address.

If the address has changed, you just need to click Relocate in the warning message, enter the new URL for the remote application of your application link, and click Relocate.

Troubleshooting