Scenario

1. JIRA is linked to Confluence using 2-Legged OAuth
2. A JIRA issue is linked to a Confluence page
3. A non-Confluence JIRA user (has a JIRA account but not a Confluence account) is not able to view the Confluence page title while viewing the JIRA issue
   • If User Impersonation is not used, the user will see:
     
   • If User Impersonation is used, the user will see:
     
     these are expected
4. A JIRA user who is also a Confluence user but does not have the permission to view the Confluence page will see:
   
   this is not expected, as the user should also see that he doesn't have the permission to view that page, rather than the page can't be loaded, which is misleading
   similarly, the browser should return a 403 error instead of 500
   JIRA Log:

   2015-06-08 18:58:51,976 http-bio-2768-exec-8 ERROR andy 1138x3274x1 1t5y8q9 192.168.1.100,0:0:0:0:0:0:0:1 /rest/viewIssue/1/remoteIssueLink/render/10100 [viewissue.issuelink.rest.RemoteIssueLinkResource] Error occurred while generating final HTML for remote issue link: java.lang.RuntimeException: java.io.IOException: Failed to load Confluence Page from remote server Caused by: java.io.IOException: Failed to load Confluence Page from remote server Caused by: com.atlassian.sal.api.net.ResponseException: Status Code: 200, Status Text: OK, Errors: {}, Error Messages: [java.lang.Exception: com.atlassian.confluence.rpc.RemoteException: You're not allowed to view that page, or it does not exist.]
   

Suggestion

JIRA should be able to detect whether the Confluence page does not exist, or the user who is viewing the JIRA issue doesn't have the permission to view that Confluence page:

1. if Confluence page does not exist (or JIRA can't connect to Confluence to determine that), it's fine to display "Failed to load" and throw 500 error
2. if the user does not have the permission to view it, JIRA should display "You do not have permission to view this page" and throw 403 error