Community Products Jira Software Questions "Atlassian's request does not comply with google policy"

[Thasni Latheef]

I have developed a teams bot application where i have integrated Jira software. I have implemented the oath2 work flow in bot . It is working fine in teams tool kit desktop and web browser application. But am getting the error ""Atlassian's request does not comply with google policy" message after we sign in step in oath2 process flow. Please provide the gudence ASAP as we need to publish the app to Microsoft market place.

[Ignacio Aredez GenAI Expert]

Review Google's OAuth2 Policies: Ensure your implementation aligns with Google's security guidelines for authentication and authorization, particularly around user data handling.

Redirect URIs Check: Confirm that your application's redirect URIs perfectly match those registered in your Google Cloud Console. Google mandates exact matches for these URIs.

Consent Screen Setup: Properly configure your OAuth consent screen in the Google Cloud Console, including application details and requested scopes. Google needs to verify screens that request sensitive scopes.

Scope Verification: Evaluate the scopes your application requests to ensure they are necessary and comply with Google's policies. Applications requiring sensitive or restricted scopes may need to undergo Google's verification process.

[Ignacio Aredez]

The error message "Atlassian's request does not comply with Google policy" typically arises during the OAuth2 flow due to a configuration or compliance issue that violates Google's policies. This can occur for various reasons, such as redirect URIs not being configured correctly, the application not meeting Google's security standards, or other policy compliance issues. To resolve this and ensure smooth integration of your Teams bot application with Jira Software, consider the following steps and checks:

Review Google's OAuth2 Policies: Ensure your OAuth2 implementation complies with Google's policies, focusing on the security guidelines and best practices for OAuth2 applications. Google has strict requirements for handling authentication and authorization, particularly concerning how user data is accessed and used.

Redirect URIs: Verify that the redirect URIs configured in your Google Cloud Console (for the OAuth2 credentials) exactly match those used in your application. Even minor discrepancies can cause this error. Google requires that all redirect URIs be pre-registered in the console and match the requests.

Consent Screen Configuration: Ensure your OAuth consent screen is correctly configured in the Google Cloud Console. This includes setting up the application name, logo, support email, and the scopes your application is requesting. The consent screen must be verified by Google, especially if you're using sensitive scopes.

Scope Verification: Review the scopes your application is requesting. If your application requests sensitive or restricted scopes, Google may require a verification process to ensure your application's compliance with their policies. Make sure you're only requesting the necessary scopes for your application's functionality.

Security Assessment: For applications requesting sensitive scopes, Google requires a security assessment from one of their approved vendors. This can be a lengthy and potentially costly process, so confirm whether this applies to your application.

Testing and Documentation: Provide thorough documentation and testing evidence of your OAuth2 flow, focusing on how user data is secured and used. This information may be necessary if you need to submit your application for review.