How to impersonate the user in Jira add-on to use Jira REST API on behalf of user

Question

I'm looking for help of somebody who knows something about Jira add-ons.

I'm trying to implement Jira add-on with an ability to create issues on behalf of a user.

So, I completed all steps (as I think) leading me to my goal, but I faced a problem with impersonating. When I try to create an issue using Jira REST API, I receive the following error:

{ "error": "Add-on 'com.example.myapp' disallowed to impersonate the user because 'no valid active user exists'" }

What was done:

Folowing the getting started tutorial I created the add-on descriptor:

{
 "name": "Hello World",
 "description": "Atlassian Connect app",
 "key": "com.example.myapp",
 "baseUrl": "https://url.ngrok.io",
 "vendor": {
     "name": "Example, Inc.",
     "url": "http://example.com"
 },
 "authentication": {
     "type": "jwt"
 },
 "scopes": [
    "act_as_user",
    "read",
    "write",
 ],
 "lifecycle": {
    "installed": "/api/created",
 },
 "apiVersion": 1
}

I also implemented webhook to handle 'installed' callback from add-on like described here. So, when a user installs the add-on the webhook will receive the following object:

{
  'key': 'com.example.myapp', 
  'clientKey': '<client key>', 
  'oauthClientId': '<OAuth client ID>', 
  'publicKey': '<public key>', 
  'sharedSecret': '<shared secret>', 
  'serverVersion': '100095', 
  'pluginsVersion': '1.250.0', 
  'baseUrl': 'https://<user's domain>.atlassian.net', 
  'productType': 'jira', 
  'description': 'Description', 
  'eventType': 'installed'
}

Using this data I generated JWT signed with the shared secret like described in the tutorial. So, my JWT payload includes the following claims:

{
  'iss': 'urn:atlassian:connect:clientid:<OAuth client ID>',
  'sub': 'urn:atlassian:connect:useraccountid:<client key>',
  'tnt': 'https://<user's domain>.atlassian.net',
  'iss': '<created at>',
  'exp': '<created at + 1 minute>'
}

The next step I performed is access token generation using auth.atlassian.io/oauth2/token endpoint and the following parameters:

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=<my JWT>&scope=ACT_AS_USER READ WRITE

The result of all these actions is an access token witch I can use to perform REST API requests. But the error described above returned every time I try to create Jira issue performing POST [user's domain].atlassian.net/rest/api/2/issue/ with Authorization: Bearer [access_token] header.

What I've noticed is that account ID in installed callback object (clientKey) has 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' (uuid) format. But when I open my account in Jira (account in witch the add-on is installed) I see that the account ID in URL has 'YYYYYY:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' format. I prepended the subject in my JWT payload with YYYYYY part:

'sub': 'urn:atlassian:connect:useraccountid:'YYYYYY:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'

and generated a new access token using this JWT. I've used new access token to create an issue and it was successfully created, the reporter of the issue is a user installed my add-on, just like I wished.

Finally, the question is: where can I find that YYYYYY part for my add-on? How to get it automatically? What I've missed following the tutorials? Any help will be appreciated.

Thank you!

How to impersonate the user in Jira add-on to use Jira REST API on behalf of user

0 Answers0