Confluence does not respond to HaloPSA webhook calls

[Mat Shaw]

We have configured HaloPSA to create documents in Confluence via webhook on the legacy format without issues. Using the new webhook format, HaloPSA gets a 200 response, but Confluence ignores the request - it does not even show up in the audit logs.

I suspect this is because HaloPSA hashes the secret key using SHA256 and does not offer an option to send the secret key raw.

Is there a way to have Confluence accept a hashed key, or to set the secret key manually (so I can enter the hashed value)?

Or any other ideas how to get around this and make this work?

[Humashankar VJ · Accepted solution]

Hi @Mat Shaw 

Based on your setup and observed behavior, it’s likely that the issue stems from how HaloPSA handles the webhook secret key.

• Confluence requires that webhook authentication be performed using an HMAC SHA256 signature, generated with the raw secret key (not a pre-hashed value).
• If the signature is computed using a pre-hashed or modified version of the key, Confluence will silently ignore the request, even though it returns an HTTP 200 status code.

Give a try with this option (middleware proxy approach) to overcome the limitation in HaloPSA is to implement a middleware proxy. This lightweight solution can be hosted on platforms like AWS Lambda, Azure Functions, or a small server.

The proxy accepts the webhook from HaloPSA, re-signs the payload with the raw secret key, and then forwards the request to Confluence with the correct HMAC signature.

Until HaloPSA supports raw key-based HMAC signing, this middleware proxy approach can offers a reliable option to establish the integration.

Hope this helps - Happy to help further!!
Thank you very much and have a great one!
Warm regards

[marc -Collabello--Phase Locked-]

This answer is not correct.  Outgoing webhooks from Confluence use a HMAC, whereas an incoming webhook from HaloPSA should not use HMAC. See:

https://confluence.atlassian.com/docm/latest/managing-webhooks-1019380708.html

and

https://support.atlassian.com/cloud-automation/docs/configure-the-incoming-webhook-trigger-in-atlassian-automation/

[Mat Shaw]

Thank you both, while I agree it seems there is some confusion in Humashankar's post about the specific requirements of each platform, the middleware suggestion is nevertheless a good one and the solution I have chosen.

I am using N8N to receive the request from Halo and then make the subsequent request to Confluence. Not only is this working well, adding N8N also gives me other capabilities that I didn't have before.

It wouldn't be ideal to have to set up an N8N server just for this one webhook, but in our business it will be useful in many other ways. So while this works for us, I realise it won't be ideal for everyone, so hopefully Confluence and/or Halo work something out. Halo for their part have said their developers are aware of the limitation on their side and have an update planned, though no ETA. Would be nice if the incoming webhook triggers on the Confluence side could have a more flexible config too.