Approver gets 403 while trying to view attachment

[Jason Freeman]

A customer created a request in the customer portal that had an attachment.  After submission, the request routed to another user for approval.

The approver cannot view the attachment.  The approver gets a 403 (Forbidden) message from JSD.  However, if I log in with my own account (which is in the jira-servicedesk-users user group), I can see the attachment just fine.

In atlassian-jira.log, I see the following message.  I am not sure if it's relevant or not, but the attachment name is the one that we are having problems with:

2019-09-13 08:42:42,761 https-jsse-nio-8443-exec-13 ERROR anonymous 522x42489x1 1a5euem 192.168.111.54 /servicedesk/customershim/secure/attachment/14627/14627_SGA+Description+for+Website+%28Sept+12%2C+2019%29.pdf [c.a.s.internal.web.CustomerContextSettingFilter] Request path does not contain servlet path. Emptying out request paths. servletPath=/servicedesk/customershim/secure/attachment/14627/14627_SGA+Description+for+Website+(Sept+12,+2019).pdf requestPath=/servicedesk/customershim/secure/attachment/14627/14627_SGA+Description+for+Website+%28Sept+12%2C+2019%29.pdf

This user viewed numerous other attachments in the past and never seen this error before.

Any ideas?

[Petter Gonçalves]

Hello Jason,

Thank you for reaching out.

It seems to be a login lack or file corruption that might be causing the error that the approver is seeing. I recommend the following steps to better troubleshoot the issue:

1 - Ask the approver to try to access the same attachment using the browser in incognito mode

2 - Is the attachment added to the ticket itself or embedded in a field? If it is in a field, make sure you added the Wiki Text Renderer to that field

3 - Per your description, the approver is a customer in your JSD, not being able to access the JIRA internal interface. Can you confirm it?

4 - Is this problem happening to other attachments in Issues created in the same project?

5 - Is any other customer facing the same behavior?

6 - Can you ask the user to add the same attachment again and a different one to check if the same problem happens?

7 - Is the same attachment accessible to any other customers and for the user that updated it?

We will be waiting to know your results.

[Jason Freeman]

1. The same thing happens in Incognito mode and in other web browsers.

2. I'm not exactly sure what this means.  It's just the standard "attachment" field.  Does that answer your question?

3. That's correct.  The user is a customer, not a full JIRA user.  If I use my full JIRA user to view the issue in JSD, I can see it just fine. 

4. The affected user only works on 1 project, and they have never had this issue before.  And there are other issues that have been created after this one that the user has no problems with.  So, this is the one and only the user is having problems with.

5. We have not heard this complaint from any other user.  In fact, even the affected user doesn't have problems with any other attachments.

6. The user isn't here right now so I will have to ask later.

7. This user is the only user who can see the attachment, other than the reporter.

[Mario Fanck]

We have the same use case. Any solutions out there?