[Update: 12 JUL 2021] Enforcement date is extended from 20th August to 29th October 2021. [Update: 15 JUL 2021] Please upgrade Atlassian Connect Express(ACE) versions to v7.4.0 or later. Previous versions ( v7.1.5 ~ v7.3.x ) automatically opts in to this new feature that results in creating a new a…

Hi @mehmetaydogdu , apologies for the confusion. After double checking the ACSB changes it looks like the configuration name has been renamed to below right before the announcement. atlassian: connect: allow-symmetric-auth-install-callback: false

[image] ekaukonen: the current signed install was introduced as a quick fix to provide better security while we move Connect over to our new internal platform. Out of curiosity: we’ve been accepting non-signed install requests since 2013. Why would you invest time & resources of both Atlassia…

I’ve been watching this discussion and I’ve got a few thoughts and concerns. All I’m really doing here is restating concerns that others have raised. This feels like a sticking plaster implementation to fix a problem that we’ve been shouting about for about as long as Connect has existed. I’m pleas…

Hi @danielwester When the publicKey gets rotated it will always be linked to a new unique kid which makes it unlikely to return a different key. If the addon server had already received a JWT token with a kid that means the public key is already available in https://connect-install-keys.atlassian.c…

Hi @OfirNir , Thanks for reporting this issue. We have patched a new version to fix this os dependent problem. Could you please check with ACSB v2.2.1 ? It should be available from maven central within a couple of hours

@HanjooSong If every key rotation generates a new kid, it is actually ok to cache the key, right? Just want to clarify as it is the opposite what was initially posted.

Do these changes affect Bamboo Plugins?

@andreas.schmidt Correct, you can cache them by kid.

No, this change does not apply to Bamboo or Bitbucket plugins

Hi @HanjooSong The comments in this thread indicate that addon.authenticateInstall() can be used for the install and uninstall routes. The latest docs imply, however, that all lifecycle methods are similarly authenticated: “Lifecycle request contains a JWT token signed with private key […]” Empiri…

The Atlassian Developer Community

Action Required - Atlassian Connect installation lifecycle security improvements

Announcements

OfirNir June 27, 2021, 6:12am 44

Looks good now, thanks!

1 Like