bdowdy,

The handler SPI described here is unique to Bitbucket Server and is not supported by Jira.

Best regards,
Bryan Turner
Atlassian Bitbucket

mheemskerk
Is it possible to use this same pattern to intercept JIRA basic auth requests, coding this same example in an Add-On? I see this uses the bitbucket HttpAuthenticationContext. Do you have any leads on if that's possible?

Thanks, when we've tested it, I will report back.

Hi rudy.holtkamp,

If you turn on HTTPS for git operations, you should be able to use LFS again. When using LFS with an ssh:// remote URL, the client retrieves the LFS HTTP url over SSH and then makes the LFS call(s) over HTTPS. The LFS urls use JWT authentication and not Basic auth, so your filter would let it through.

That's the theory at least. I haven't tested it locally though..

Hi mheemskerk, thanks for your answer.
A follow-up question about this. Suppose I write this plugin and turn on https for git operations again can I then use git LFS operations. Because with the current setup (allowing only ssh git operations) I can't use LFS.

rudy.holtkamp FYI. Basic auth is not supported for logging into the Web UI to begin with; it's only accepted for REST and git operations. If you don't want to support git operations over HTTP, you can turn it off under Admin > Server Settings.

But if you're willing to write a small plugin, you'll be able to turn off basic authentication completely. What you'll need to do is write a HttpAuthenticationHandler, and implement it as follows:

    @Override
    public ApplicationUser authenticate(@Nonnull HttpAuthenticationContext context) {
        if (HttpAuthenticationContext.METHOD_BASIC.equals(context.getMethod())) {
            throw new BasicAuthNotSupportedException(i18nService.createKeyedMessage("your.i18n.here"));
        }
        return null;
    }

where BasicAuthNotSupportedException needs to be subclass of AuthenticationException.

Finally, register the auth handler in your atlassian-plugin.xml with a low enough weight that it's ordered before the built-in handlers (19 should be low enough):

<http-auth-handler key="crowdSsoAuthHandler" weight="19" class="com.your.package.NoMoreBasicAuthHttpHandler"
                   captcha-support="false"/>

The captcha-support is to ensure that people don't accidentally get locked out when they (or a script) tries to use basic auth.