When you configure authentication for an application link, you are defining the level of trust between FishEye and the application that it is linked to. On this page:

Choosing Authentication for an Application Link

The level of authentication that you should configure for your application link depends on a number of factors.

• Do the two applications trust each other? In other words, are you sure that the code in the application will behave itself at all times and that the application will maintain the security of its private key?
• Do the two applications share the same user base?
• Do you have administrative access to the application you are linking to?

Common scenarios include:

• If the two applications you are linking trust each other and share the same user base, configure two-way authentication using Trusted Applications for both incoming and outgoing authentication. For example, you may link your internal FishEye server to an internal JIRA server.
• If the two applications you are linking trust each other but do not share the same user base, configure two-way authentication using OAuth for both incoming and outgoing authentication. For example, you may link your internal FishEye server to an external (customer-facing) JIRA server.
• If you do not have administrative rights to the application that you are linking to (for example, linking to a public FishEye server), configure a one-way outgoing link authenticated using basic HTTP authentication or do not configure any authentication for the link. For example, you may link your external FishEye server to a partner organisation's FishEye server. An unauthenticated link will still allow the local application to render hyperlinks to the remote application or query anonymously-accessible APIs.

The flowchart below provides a guide to what authentication you should configure for your application link.

Read the following topics for information on how to configure authentication for an application link:

Flowchart above: Determining what authentication to configure for an Application Link

Security Implications for each Authentication Type

If you configure Trusted Applications authentication for your application (meaning that your servers have the same set of users and they fully trust each other) please be aware of the following security implications:

If you configure OAuth authentication for your application (meaning that your servers have different sets of users and they fully trust each other) please be aware of the following security implications:

Screenshot above: Configuring authentication during application link setup

About Primary Authentication Types

About Impersonating and Non-Impersonating Authentication Types

Incoming and Outgoing Authentication