-
Type:
Bug
-
Resolution: Incomplete
-
Priority:
Low
-
None
-
Affects Version/s: 9.12.21
-
Component/s: User Management - Others
-
None
-
9.12
-
1
-
Severity 3 - Minor
- Issue Summary
- When configuring a Jira User Server application entry, the Authentication Dropdown in the UI presents OAuth2 App Links as an available credential option. Jira User Server is a legacy basic authentication feature that allows Jira to act as a user directory for other Atlassian products (e.g., Confluence). It has no OAuth2 workflow support. The presence of OAuth2 App Links in the dropdown is misleading and unsupported — selecting it does not produce a meaningful error and can cause administrators to misconfigure the feature, leading to HTTP 500 errors during downstream directory sync operations (e.g., Confluence Full Sync via /rest/usermanagement/1/group/membership).
- Steps to Reproduce
- 1. Stand up a Jira Data Center instance (confirmed on 10.3.21; believed to affect earlier versions)
2. Stand up a second Atlassian product instance (e.g., Confluence Data Center) configured to use Jira as a User Directory
3. In Jira, navigate to Administration → User Management → Jira User Server
4. Click Add Application (or edit an existing application entry)
5. Observe the Authentication dropdown field
6. Note that OAuth2 App Links appears as a selectable option alongside basic authentication credentials
7. Select OAuth2 App Links as the authentication method and save the configuration
8. In Confluence, navigate to Administration → User Management → User Directories and trigger a Full Synchronization against the Jira User Server directory
9. Observe the result — the sync will fail with an HTTP 500 error on GET /rest/usermanagement/1/group/membership
10. Check the Confluence log — you will see: com.atlassian.crowd.exception.OperationFailedException with no meaningful diagnostic output, indicating that OAuth2 was the unsupported selection - Expected Results
- • OAuth2 App Links should not appear in the Authentication Dropdown for Jira User Server application entries — this option is only valid for OAuth2-capable workflows, not for the legacy User Server feature
• If OAuth2 App Links is somehow selectable, the UI should display a clear validation error explaining that User Server only supports basic authentication
• Alternatively, selecting an unsupported authentication method should produce a clear, actionable error at sync time rather than a generic HTTP 500 - Actual Results
- • OAuth2 App Links appears as a valid, selectable authentication option in the Jira User Server application entry UI
• No warning or validation error is shown when OAuth2 App Links is selected for a User Server entry
• Downstream sync operations (e.g., Confluence Full Sync) fail with HTTP 500 on /rest/usermanagement/1/group/membership
• The 500 error does not indicate that the authentication method is the root cause, making diagnosis extremely difficult
• The JVM flag -Datlassian.oauth2.provider.invalidate.session.enabled=false is required to restore functionality, which is a non-obvious workaround unrelated to the actual misconfiguration - Workaround
- Workaround:
Use basic authentication credentials (application name + password) for the Jira User Server application entry instead of OAuth2 App Links. Additionally, the JVM flag -Datlassian.oauth2.provider.invalidate.session.enabled=false in Jira's JVM arguments has been confirmed to restore sync functionality in affected environments.