Configuring authentication for an application link is essentially defining the level of trust between JIRA and another application. On this page:

Choosing Authentication for an Application Link

The level of authentication that you should configure for your application link depends on a number of factors.

• Do the two applications you are linking trust each other? i.e. are you sure that the code in the application will behave itself at all times and that the application will maintain the security of its private key?
• Do the two applications you are linking share the same set of users and user names?
• Do you have administrative access to the application you are linking to JIRA?

Common scenarios include:

• If the two applications you are linking trust each other and share the same set of users and user names, configure two-way authentication using Trusted Apps for both incoming and outgoing authentication. For example, you may link your internal JIRA server to an internal FishEye server.
• If the two applications you are linking trust each other but do not share the same set of users or user names, configure two-way authentication using OAuth for both incoming and outgoing authentication. For example, you may link your internal JIRA server to an external (customer-facing) Confluence server.
• If you do not have administrative rights to the application that you are linking to (e.g. linking to a public FishEye server), configure a one-way outgoing link authenticated using basic HTTP authentication or do not configure any authentication for the link. For example, you may link your external Confluence server to a partner organisation's Confluence server. An unauthenticated link will still allow the local application to render hyperlinks to the remote application or query anonymously-accessible APIs.

The flowchart below provides a guide to what authentication you should configure for your application link.

Read the following topics for information on how to configure authentication for an application link:

Flowchart above: Determining what authentication to configure for an Application Link

Security Implications for each Authentication Type

If you configure Trusted Apps authentication (i.e. both applications fully trust each other and have the same set of users and user names), please be aware of the following security implications:

If you configure OAuth authentication (i.e. both applications fully trust each other but have different sets of users or user names), please be aware of the following security implications:

Screenshot above: Configuring authentication during application link setup

About Primary Authentication Types

About Impersonating and Non-Impersonating Authentication Types