We use webhook in Jira DC a lot. Now we are considering to adopt Jira cloud and want to have similar webhook functionality in Jira cloud. We have A4J which is little more secure than traditional webhook feature in Jira cloud.
Even though in A4J, one can secure API by adding Authorization header, but that does not fulfil organisation security needs..
We are looking for MATLS feature which is to ensure connection are trusted from Jira Cloud to on-premise CI systems and vice-versa.
We use webhook to trigger CI pipeline if any configured events occurs.
- links to
- mentioned in
-
Page Failed to load
[JIRAAUTOSERVER-322] Secure 'send web request' action with MATLS
| Labels | Original: iq-a4j | New: iq-a4j ril |
| Remote Link | New: This issue links to "Internal ticket (Web Link)" [ 979097 ] |
| UIS | New: 0 |
| Labels | New: iq-a4j |
| Component/s | Original: A4J DoS [ 61319 ] |
| Remote Link | New: This issue links to "Page (Confluence)" [ 643878 ] |
| Link | New: This issue is related to ENT-558 [ ENT-558 ] |
At every trigger, webhook should send the Jira cloud's certificate and key information which can be validated by target system.
We were exploring Jira cloud webhook integration with self-hosted CI systems within the Organisation. This requires exposing webhook endpoint via our API Gateway over internet. Traffic flow would be like:
Jira cloud API Gateway On-premise CI systems
In order to setup this, we need to establish an authentication mechanism between Jira cloud and API Gateway. The security recommended authentication method should be using mTLS/maTLS.
That would be a great feature! We're also using Jira Automation to make API Calls and one of our systems requires MTLS so we're not able to fully integrate Jira with that system. We need the ability to add the client certificate in the Jira Automation rule so the web requests triggered from Jira can be authenticated by our API Gateway.