Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.

Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.

*Except Fisheye and Crucible

Summary

Attempting to connect to Jira as a user repository (using Jira's User Server function) fails with the following message in the UI – the password is correct:

Failed to change the active user repository: com.atlassian.crowd.exception.ApplicationPermissionException: Forbidden (403) Encountered a "403 - Forbidden" error while loading this page. Go to JIRA home

Diagnosis

The following appears in the $BAMBOO_HOME/logs/atlassian-bamboo.log

2016-07-20 14:15:39,010 ERROR [http-apr-8085-exec-23] [DefaultUserAccessor] Error in getUser():com.atlassian.crowd.exception.ApplicationPermissionException: Forbidden (403) Encountered a "403 - Forbidden" error while loading this page. Go to JIRA home
com.atlassian.user.EntityException: com.atlassian.crowd.exception.ApplicationPermissionException: Forbidden (403) Encountered a "403 - Forbidden" error while loading this page. Go to JIRA home
	at com.atlassian.crowd.integration.atlassianuser.UserGroupCache.fetchAndSetSnapshot(UserGroupCache.java:110)
	at com.atlassian.crowd.integration.atlassianuser.UserGroupCache.get(UserGroupCache.java:143)
	at com.atlassian.crowd.integration.atlassianuser.CrowdUserManager.getUser(CrowdUserManager.java:29)
	at com.atlassian.user.impl.delegation.DelegatingUserManager.getUser(DelegatingUserManager.java:73)
	...
Caused by: com.atlassian.crowd.exception.ApplicationPermissionException: Forbidden (403) Encountered a "403 - Forbidden" error while loading this page. Go to JIRA home

	... 240 more

Cause

The following are possibilities:

1. JIRA does not include Bamboo server IP address in JIRA User Server settings or has not whitelisted "localhost" if both applications are installed on the same server.
2. The IP address of to the incoming request from Bamboo to Jira is the address of the load balancer / reverse proxy in-front of Jira that is forwarding the request, not the IP Address of the Bamboo Server.
3. There is a proxy or firewall that blocks such access from Bamboo to Jira.

Solution

1. Ensure that the Bamboo server URL (or IP address) has been added to JIRA User Server connector or whitelist.
   1. If you see that you are still getting the same error, please check the Tomcat access logs in  $JIRA-INSTALL/logs/access_log.yyyy-mm-dd for the correct source IP addresses.
2. Ensure that the IP Address of the load balancer or reverse proxy in-front of JIRA has also been whitelisted against the Bamboo application defined at Jira Administration >> User Management >> JIRA User Server >> Edit 
   
3. Configure any proxy or firewall (rules blocking the access, NAT or PAT etc.) that might block such access. You might want to follow this method Configuring Web Proxy Support for Confluence or review the rules in your firewall or even the logs to see if these packages are being dropped. Try bypassing the proxy. For instance, if both JIRA and Bamboo are on the same server, use 127.0.0.1 to connect. From Connecting to JIRA for User Management:

   1. "Go to your Jira administration screen and define the Bamboo application to Jira", item 5, configure the following IPs:

      127.0.0.1
      ::1
      your.hostname

   2. "Set up the Jira user directory in Bamboo", item 4, configure http://127.0.0.1:port/context_path on the "Server URL" settings.

   3. Alternatively, use the IPs of Bamboo and Jira if they have a direct connection to each other through the network.