# JIRA Server Integration - Which Auth mechanism to use?

**URL:** <https://community.developer.atlassian.com/t/jira-server-integration-which-auth-mechanism-to-use/4933>\
**Category:** Jira Server\
**Created:** [June 8, 2017, 12:27pm UTC](https://community.developer.atlassian.com/t/jira-server-integration-which-auth-mechanism-to-use/4933 "2017-06-08T12:27:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vrav](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/vrav/32/33907_2.png) [@vrav](https://community.developer.atlassian.com/u/vrav)\
**Post date:** [June 8, 2017, 12:27pm UTC](https://community.developer.atlassian.com/t/jira-server-integration-which-auth-mechanism-to-use/4933/1 "2017-06-08T12:27:24Z")

</div>

Hello,

We are building an application that integrates with JIRA Server using the REST APIs.  
The problem is that we want to use OAuth for authenticating the requests but JIRA has a 3-legged version of OAuth1.0a where there is user interaction.

Since our app **doesn’t have any UI** and is basically just a batch job that imports/exports data, we can’t use this.  
Does JIRA support the 2-legged version of OAuth 1.0a or should we just use basic auth instead?

Thanks in advance for your help.

Regards,  
Vijay

---

<div class="post-metadata">

**Author:** ![david.pinn](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/david.pinn/32/36134_2.png) [@david.pinn](https://community.developer.atlassian.com/u/david.pinn)\
**Post date:** [June 9, 2017, 9:01am UTC](https://community.developer.atlassian.com/t/jira-server-integration-which-auth-mechanism-to-use/4933/2 "2017-06-09T09:01:17Z")

</div>

> [@vrav](#):
>
> Does JIRA support the 2-legged version of OAuth 1.0a or should we just use basic auth instead?

The [OAuth documentation for AppLinks](https://confluence.atlassian.com/applinks/oauth-security-for-application-links) says this:

> “Impersonating authentication makes requests on behalf of the user who is currently logged in.  
> Note that Atlassian OAuth with impersonation can only be used for application links between Atlassian applications.”

I’d say you’ll have to use HTTP basis auth.

---

<div class="post-metadata">

**Author:** ![vrav](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/vrav/32/33907_2.png) [@vrav](https://community.developer.atlassian.com/u/vrav)\
**Post date:** [June 14, 2017, 10:02am UTC](https://community.developer.atlassian.com/t/jira-server-integration-which-auth-mechanism-to-use/4933/3 "2017-06-14T10:02:35Z")

</div>

Thanks for your response @david.pinn. I found that there’s an option in the OAuth configuration page called ‘Allow 2-Legged OAuth’. I have now enabled it but I’m yet to verify that it indeed works. I will update once I try it out.

---

<div class="post-metadata">

**Author:** ![vrav](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/vrav/32/33907_2.png) [@vrav](https://community.developer.atlassian.com/u/vrav)\
**Post date:** [June 21, 2017, 8:18am UTC](https://community.developer.atlassian.com/t/jira-server-integration-which-auth-mechanism-to-use/4933/4 "2017-06-21T08:18:58Z")

</div>

Hello @david.pinn,

Here’s what I did.

1. Enabled ‘Allow 2-Legged OAuth’.
2. Entered a valid user id in ‘Execute As’.
3. Got the request token using my external client.
4. Tried to get the access token using the request token but got the error oauth\_problem=permissions\_unknown.

I’m guessing this is because I haven’t authorised the access token, but my understanding is that for the 2-legged version this isn’t required. Am I missing something? Please help.

Thanks,  
Vijay

---

<div class="post-metadata">

**Author:** ![david.pinn](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/david.pinn/32/36134_2.png) [@david.pinn](https://community.developer.atlassian.com/u/david.pinn)\
**Post date:** [June 21, 2017, 1:16pm UTC](https://community.developer.atlassian.com/t/jira-server-integration-which-auth-mechanism-to-use/4933/5 "2017-06-21T13:16:42Z")

</div>

I’d be happy to learn otherwise, but for now I still maintain that 2-Legged OAuth in JIRA is only available in the context of links (AppLinks) between Atlassian applications.

See, for example: [Details of 2-legged OAuth (2LO) with impersonation](https://confluence.atlassian.com/kb/details-of-2-legged-oauth-2lo-with-impersonation-857064486.html).

---

<div class="post-metadata">

**Author:** ![vrav](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/vrav/32/33907_2.png) [@vrav](https://community.developer.atlassian.com/u/vrav)\
**Post date:** [June 21, 2017, 1:58pm UTC](https://community.developer.atlassian.com/t/jira-server-integration-which-auth-mechanism-to-use/4933/6 "2017-06-21T13:58:29Z")

</div>

Yeah I saw that but what I understand is that OAuth with impersonation is only for Atlassian applications but it’s not clearly mentioned anywhere that even without the impersonation, it wouldn’t work.

The way the current implementation works, I’d say there’s no difference between 3-Legged and 2-Legged so I’m stuck with Basic Auth which is sad really.

Regards,  
Vijay