Breaking behavior with Anonymous users and Atlassian Spring Connect

Forge Adopting Forge from Connect
1

We’re relying (until migration to Forge completes) on the Atlassian Spring Connect for the Forge Remote implementation.

Our app also supported anonymous Confluence users. It behaved slightly different when detected a anonymous user. We checked if AtlassianHostUser.getUserAccountId().isEmpty() to do so.

When you move the endpoint to a Forge Remote, the `AtlassianHostUser`is set as before. HOWEVER: the AtlassianHostUser.getUserAccountId() is then set for anonymous users. It is set to unidentified for anonymous users.

This means, our existing code missed the anonymous users and assumed they are logged in.

2

Thanks for the heads up @RomanStoffel!

Looks as though unidentified is the value provided in the principal field of the Forge invocation token (FIT) for anonymous users, rather than this being ACSB-specific behaviour.

3

Correct: The Force Invocation Tokens FIT principal is set to unidentified for anonymous users. This is then taken 1:1 by the Atlassian Spring Connect implementation and breaks the previous behavior where was no getUserAccountId for anonymous user.

Just to clarify: We’ll just fix in our application. We’ll soon drop the Atlassian Spring Connect framework anyway. Just letting everyone know =).