-
Type:
Suggestion
-
Resolution: Unresolved
-
Component/s: Forge - External API Authentication
-
None
When using Forge Remote with a Spring Boot backend in Confluence, calling asUser() for an authenticated guest user (a real Atlassian account that is unlicensed in Confluence) fails with:
• CQL: 403 Forbidden — "Current user not permitted to use Confluence"
• REST v2: 404 Not Found
This occurs even when the app manifest correctly declares unlicensedAccess for the affected modules:
unlicensedAccess:
- unlicensed
- anonymous
Steps to Reproduce
1. Create a Forge app with a Spring Boot remote backend using the Forge Java SDK.
2. Declare unlicensedAccess: [unlicensed, anonymous] on the relevant Confluence module in manifest.yml.
3. Ensure a guest user has been granted access via global permissions and the Collaborator role.
4. Have the guest user load the app and trigger a backend call using asUser():
atlassianForgeRestClients.asUser().requestConfluence()
.getForEntity("/api/v2/spaces/{id}?include-operations=true", Object.class);
5. Observe the 403/404 error response.
Expected Behavior
Guest users (authenticated, unlicensed) should be able to make asUser() calls in Forge Remote, consistent with the behavior available in Atlassian Connect, where user-initiated actions preserved user identity and authorization context.