Uploaded image for project: 'FishEye'
  1. FishEye
  2. FE-5364

2LOi requests made from an application that has the username in a different case than FishEye/Crucible aren't authenticated properly even if 'force lowercase' is set

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Medium Medium
    • 3.8.1, 3.9.0
    • 2.2.0, 3.6.4
    • None

      The implementation of com.atlassian.sal.api.user.UserManager#resolve, doesn't consider the 'force lowercase'
      setting when processing the username provided in the 2LO request. This will cause the request to continue being processed as anonymous (as the 2lo validation succeeds, but it didn't have a valid username).

      This potentially affects other auth methods that try to resolve a username (like trusted apps). 3LO is not affected, as the exact-cased username is stored with the 3LO token when creating the token.

      Effects of this might include requests made from other applications with such a configuration to be treated as anonymous requests, and show incomplete or no data, depending on the request type and Fisheye's configuration.

      A workaround is to use 3-legged OAuth for such configurations.

            [FE-5364] 2LOi requests made from an application that has the username in a different case than FishEye/Crucible aren't authenticated properly even if 'force lowercase' is set

            Owen made changes -
            Workflow Original: FE-CRUC Bug Workflow [ 2944774 ] New: JAC Bug Workflow v3 [ 2958812 ]
            Owen made changes -
            Workflow Original: FECRU Development Workflow - Triage - Restricted [ 1518241 ] New: FE-CRUC Bug Workflow [ 2944774 ]
            Owen made changes -
            Workflow Original: FECRU Development Workflow - Triage [ 944963 ] New: FECRU Development Workflow - Triage - Restricted [ 1518241 ]
            Yit Wei made changes -
            Affects Version/s New: 3.6.4 [ 50800 ]
            Piotr Swiecicki made changes -
            Workflow Original: FECRU Development Workflow (Triage) [ 751930 ] New: FECRU Development Workflow - Triage [ 944963 ]

            Antonio Cerezo Iglesias added a comment -

            Great news! Thank you for the update!

            For now we've applied the suggested workaround and it works.

            Thanks and regards,
            Antonio

            Antonio Cerezo Iglesias added a comment - Great news! Thank you for the update! For now we've applied the suggested workaround and it works. Thanks and regards, Antonio
            Lukasz Pater made changes -
            Story Points New: 2
            Lukasz Pater made changes -
            Sprint Original: 3.9-bug-anihilation [ 2271 ] New: 3.9-m4 [ 2216 ]
            Lukasz Pater made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Quality Review [ 10029 ] New: Closed [ 6 ]

            Lukasz Pater added a comment -

            This will be included in the upcoming 3.8.1 release

            Lukasz Pater added a comment - This will be included in the upcoming 3.8.1 release

              lpater Lukasz Pater
              lpater Lukasz Pater
              Affected customers:
              2 This affects my team
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: