Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-43781

Improve Warning Messages when JIRA User is Not Allowed to view Confluence Page

    XMLWordPrintable

Details

    • We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

    Description

      NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion.

      Scenario

      1. JIRA is linked to Confluence using 2-Legged OAuth
      2. A JIRA issue is linked to a Confluence page
      3. A non-Confluence JIRA user (has a JIRA account but not a Confluence account) is not able to view the Confluence page title while viewing the JIRA issue
        • If User Impersonation is not used, the user will see:
        • If User Impersonation is used, the user will see:

          these are expected
      4. A JIRA user who is also a Confluence user but does not have the permission to view the Confluence page will see:

        this is not expected, as the user should also see that he doesn't have the permission to view that page, rather than the page can't be loaded, which is misleading
        similarly, the browser should return a 403 error instead of 500
        JIRA Log:
        2015-06-08 18:58:51,976 http-bio-2768-exec-8 ERROR andy 1138x3274x1 1t5y8q9 192.168.1.100,0:0:0:0:0:0:0:1 /rest/viewIssue/1/remoteIssueLink/render/10100 [viewissue.issuelink.rest.RemoteIssueLinkResource] Error occurred while generating final HTML for remote issue link: java.lang.RuntimeException: java.io.IOException: Failed to load Confluence Page from remote server Caused by: java.io.IOException: Failed to load Confluence Page from remote server Caused by: com.atlassian.sal.api.net.ResponseException: Status Code: 200, Status Text: OK, Errors: {}, Error Messages: [java.lang.Exception: com.atlassian.confluence.rpc.RemoteException: You're not allowed to view that page, or it does not exist.]
        

      Suggestion

      JIRA should be able to detect whether the Confluence page does not exist, or the user who is viewing the JIRA issue doesn't have the permission to view that Confluence page:

      1. if Confluence page does not exist (or JIRA can't connect to Confluence to determine that), it's fine to display "Failed to load" and throw 500 error
      2. if the user does not have the permission to view it, JIRA should display "You do not have permission to view this page" and throw 403 error

      Attachments

        1. 2_legged.png
          2_legged.png
          80 kB
        2. 500_error.png
          500_error.png
          77 kB
        3. impersonation.png
          impersonation.png
          94 kB

        Issue Links

          Activity

            People

              Unassigned Unassigned
              vdung Andy Nguyen (Inactive)
              Votes:
              6 Vote for this issue
              Watchers:
              12 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: