JIRA Server for slack (official) plugin Integration failing to connect Slack to Jira

Still need help?

The Atlassian Community is here for you.

Ask the community


Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.

Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.

*Except Fisheye and Crucible

The content of this page is applicable for all Jira / Jira Software versions of 7.5.4 and up.

Problem

Upon installing the JIRA Server for slack (official) plugin and trying to have Slack to connect to the target Jira instance, an error is report by Slack that it can’t reach the Jira instance and report the below error message:

Diagnosis

Environment

    • Jira is installed in public internet facing configuration and is using HTTPS.

    • The Atlassian JIRA Server for slack (official) plugin is installed.

    • Jira is able to reach to Slack, but Slack is not able to communicate with Jira and giving the above error.

Diagnostic Steps

  • Verify the Jira tomcat access logs for requests incoming from Slack to Jira, the logs are found at the location <JIRA_INSTALLATION_DIR>/logs/access_logs.YYYY-MM-DD.

    We need to verify if there are requests incoming to Jira from Slack User-agents, please check the Slack API documentation for more info about Slack robots: https://api.slack.com/robots

    The logs looks like below:

    203.0.113.11 111x111111x11 - [01/sep/2019:12:32:32 +0000] "POST /slack/event HTTP/1.1" 200 9300 46 "-" "Slackbot 1.0 (+https://api.slack.com/robots)" "-"
    203.0.113.11 111x111111x12 - [01/sep/2019:12:32:35 +0000] "POST /slack/event HTTP/1.1" 200 9300 237 "-" "Slackbot 1.0 (+https://api.slack.com/robots)" "-"
    203.0.113.101 111x111111x13 - [01/sep/2019:12:32:38 +0000] "POST /slack/event HTTP/1.1" 200 9298 48 "-" "Slackbot 1.0 (+https://api.slack.com/robots)" "-"
    203.0.113.11 111x111111x14 - [01/sep/2019:12:32:47 +0000] "POST /slack/event HTTP/1.1" 200 9298 45 "-" "Slackbot 1.0 (+https://api.slack.com/robots)" "-"
    ....
    203.0.113.200 111x111111x90 - [01/sep/2019:14:04:14 +0000] "GET /secure/CreateIssue.jspa?pid=11111&issuetype=3&issueTemplateId=550 HTTP/1.1" 302 - 2 "-" "Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots)" "-"
    203.0.113.101 111x111111x91 - [01/sep/2019:14:04:20 +0000] "GET /favicon.ico HTTP/1.1" 200 6093 2 "-" "Slackbot 1.0 (+https://api.slack.com/robots)" "-"
    203.0.113.101 111x111111x93 - [01/sep/2019:14:05:38 +0000] "GET /browse/TEST-11 HTTP/1.1" 302 - 8 "-" "Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots)" "-"
    203.0.113.101 111x111111x94 - [01/sep/2019:14:05:40 +0000] "GET /favicon.ico HTTP/1.1" 200 6093 2 "-" "Slackbot 1.0 (+https://api.slack.com/robots)" "-"

    Looking at the above logs, its clear that Slack is able to send requests to Jira and that Jira is replying with an HTTP 200 code and an HTTP 302 in other cases, this proves that the requests make it to Jira, and thus are not block by a reverse proxy or a firewall but still for some reason, the integration is failing.

  • Another key diagnostic step is to check the URL https://<JIRA_BASE_URL/slack/event and making sure that Jira is responding properly on POST requests for that URL. 

    This URL is used Slack to verify the Jira URL, more information could be found in the slack documentation: https://api.slack.com/events/url_verification

    This URL should be an unauthenticated anonymous end point on Jira side, that expects only HTTP POST requests requesting a Slack Challenge in the following format:

    {
        "token": "Jhj5dZrVaK7ZwHHjRyZWjbDl",
        "challenge": "3eZbrw1aBm2rZgRNFdxV2595E9CY3gmdALWMmHkvFXO7tYXAYM8P",
        "type": "url_verification"
    }

    Jira should then respond to the challenge request with the same challenge string in URL encoded mime or JSON format.
    The above URL should be exposed to the public internet on HTTPS scheme and shouldn't be intercepted by an SSO login or be block by any other means, eg: by a reverse proxy or a plugin to block anonymous access.

Cause

In this case, the root cause of the issue was:

  • Jira is running behind SAML SSO which enforces login for all URLs, this will result in redirecting the requests posted to https://<JIRA_BASE_URL/slack/event to the SSO login page for authentication which will break the integration with Slack.

  • Jira has a plugin to prevent anonymous access to Jira URLs (an example would be the plugin Prevent Anonymous Access ) installed and not properly configured which might block the Slack integration functionality.
    This would prevent JIRA from sending the proper response to Slack and would instead be sending a login page. There might be no redirects sent in this case, and thus it is important to verify the URL https://<JIRA_BASE_URL/slack/event and to ensure it is working as expected.

Resolution

The main fix for this problem is to unblock the URL https://<JIRA_BASE_URL/slack/event, and to ensure there is no authentication intercepting it (as a result of SSO integration for example) or any configuration that would block it either it would be in a reverse proxy or a Jira plugin.

  • If JIRA is integrated with an SSO solution, the URL should be white listed from the SSO functionality as Slack will not be able to handle redirects to login pages.
  • The URL expects only POST requests and Jira should be able to respond to those requests once received, thus, external network connectivity to Jira is mandatory in this case.
  • The URL must be open to public internet and uses HTTPS, plain text HTTP is not support for the Integration with Slack.
  • In case a JIRA plugin is used to block anonymous access, please ensure that the above URL is white listed from the plugin functionality so that the URL is not blocked and JIRA is able to provide response on anonymous POST requests to that URL.


DescriptionJIRA Server for slack (official) plugin Integration failing to connect Slack to Jira
ProductJIRA
Last modified on Sep 13, 2019

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.