_aboutImpersonatingAuthTypes

Atlassian's application links provide both OAuth and OAuth with impersonation authentication types:

OAuth authentication

Non-impersonating authentication allows you to link applications when the applications don't share the same userbase.

It always uses a pre-configured user, and not the logged-in user, when making a request. The server handling the request determines the level of access to use based on the access permissions of that pre-configured user, and this is used for requests from all users.

See OAuth security for application links for more information.

OAuth with impersonation

Impersonating authentication makes requests on behalf of the user who is currently logged in. People see only the information that they have permission to see. This authentication type should only be used when both applications share the same userbase, typically managed with an external directory using LDAP.

Impersonation provides greater convenience for your users – they don't need to authenticate when they request restricted resources from the remote application. The following restrictions apply:

• Both applications must be Atlassian applications.
• Both applications should share the same userbase.

See OAuth security for application links for more information.