Invoking Forge storage api using api token and basic auth

[MukeshkumarJain]

Hi All ,

Is it possible to invoke storage api of forge framework from a non-forge backend application using Jira api token and basic auth ?

Thanks,
Mukesh

[ibuchanan]

@MukeshkumarJain,

No. It’s not possible. The capability (but with a different auth model) was recently discussed here:

RFC-34: Forge remote - retrieving new access tokens at any time

RFCs are a way for Atlassian to share what we’re working on with our valued developer community. It’s a document for building shared understanding of a topic. It expresses a technical solution, but can also communicate how it should be built or even document standards. The most important aspect of an RFC is that a written specification facilitates feedback and drives consensus. It is not a tool for approving or committing to ideas, but more so a collaborative practice to shape an idea and to fi…

[klaussner]

@MukeshkumarJain You can upvote this feature request in the Forge issue tracker: Issue navigator - Ecosystem Jira

[ibuchanan]

@klaussner,

Thanks for sharing that issue. And I encourage watch, vote, and comment. As written, I don’t think there is enough for the appropriate Product Manager (PM) to understand the problem you are trying to solve and why his proposed solution (in the RFC) would not work. Currently, the PM has articulated some self-imposed constraints to help establish a stronger security posture for Forge, which were subsequently elaborated by one of the engineers as these 3 constraints:

That being said we also need to achieve the following Security Controls:

1. Time limited access credentials
2. Tenant Isolated access credentials
3. Policy enforcement checks at point of credential refresh

At this time, API Tokens would not meet those constraints. Hence, a deeper articulation of the problem you are trying to solve on the issue would be necessary to negotiate a compromise.

Further conversation on this thread won’t help us toward that goal. So for @MukeshkumarJain and anyone else looking for API Tokens for Forge Storage should please take the concerns to the open issue FRGE-1308. I’m locking this thread in favor of moving conversation there.