How to authenticate a client when a single Atlassian Connect app is installed on many JIRA Clouds

[Paul Woolley]

I have a sinlgle Atlassian Connect app running, which can be "installed" in to multiple JIRA Cloud instances.

My Atlassian Connect app also exposes a web api that allows a client to query a JIRA Cloud for issue details.

On the web api the client will specify 1) what issue to fetch, 2) the URL of the JIRA Cloud to contact and 3) the JIRA Cloud username to act as (because I'm using the ACT_AS_USER scope).

My Atlassian Connect app is trusted by all the JIRA Clouds it is installed on, so my app is allowed to acquire an OAuth2 token for the desired JIRA Cloud and start making requests on behalf of the desired username.

But here's the real question...if client A were to discover the URL and a valid username of client B's JIRA Cloud, what is there to stop client A from using my app's web api to fetch the details of issues from client B's JIRA Cloud?

Am I missing something here?  Is there something else build in to the Atlassian Connect app framework that helps guard against this?  What could I do to ensure that only client A can make requests on client A's JIRA Cloud and not misuse any of the other JIRA Clouds that the app is trusted for?

[Dario B · Accepted solution]

Hi @Paul Woolley,

I believe you will have better luck if you ask the same question in the developers community:

• https://community.developer.atlassian.com/

Then, in case of no success, you can get further  support by logging a request into:

• https://ecosystem.atlassian.net/servicedesk/customer/portal/14

I hope this helps.

Best Regards,
Dario
Atlassian Cloud Support  

[Paul Woolley]

Thanks @Dario B.  Reposted here: https://community.developer.atlassian.com/t/how-to-authenticate-a-user-when-a-single-atlassian-connect-app-is-installed-on-many-jira-clouds/20822

[Dario B]

You are very welcome. 

That's the community where all the other developers are and there are bigger chances someone else already tried or asked the same thing :) 

Have a nice day!