Expose Jira Service Management Rest Api to Customers via OAuth?

[tylerjvollick]

Hi there. I am a developer on a team that builds and maintains a web app portal for a service based company. Our users authenticate into our portal via okta. We are looking to integrate Jira Service Management into our portal to allow customers to create requests of various kinds. However, i have been tasked with building this integration in a way that does not force our users to leave our portal. I was hoping it would be possible to use the Oauth2.0 flow as documented (https://developer.atlassian.com/cloud/jira/service-desk/oauth-2-authorization-code-grants-3lo-for-apps/) and use the access token gained to make requests to the Service Management Rest API to allow a customer to create/read their requests all within our web app.

I've managed to create a test app in jira to test the oauth2 flow and have it working for my admin user. However, the Oauth flow does not seem to support customer accounts. I'm guessing this is because there is no site/resource in a sense? 

I found this similar request from april 22 that seems to boil down to using basic auth to make this happen? I was hoping this is not still the case as basic auth seems problematic using certain api's such as getting customer requests on behalf of the customer who's actually making the request. 

Any help would be greatly appreciated! 

https://community.atlassian.com/t5/Jira-Service-Management/Connecting-a-customer-account-to-Jira-REST-Api/qaq-p/1905816

[ELFAPP Technologies]

Hi

I believe the way you should look at this problem is how can you determine what a user is and what action can a user perform within your app. For example, you know who the users are because they authenticate via okta. I haven't tried this personally for JSM customers but with Oauth you can do a user impersonation. You can find out if this can be used to attain the results you need.

Other than that, you can create a sort of [service account](which is an actual Jira user account) that will be used for accessing all the JSM API required to perform an action. In your app, this service user can auth through Oauth to access the Atlassian API, you can use this service user to query or apply any changes that the user (given that you already can identify who a user is from the okta login) makes from your integration to your JSM project. When these users create request in your portal, the service user will handle all the creation, comments etc.

In both scenarios, your integration should rely on using the accountId of the customer user to keep track of who a user is within your portal, so you can easily query for actions done by this user.