Jira Integration

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello Sailors,

So I got a requirement to manage Jira user LCM in SailPoint ISC/IDN.

I did a POC using OOTB connector Atlassian Suite - Cloud connector, below are the problems I am facing. Not sure how this OOTB connector is built, maybe it is calling Atlassian Cloud APIs internally.

  1. Not able to get last login, it is the limitation from Jira API itself. So cannot question the connector.
  2. The big problem is with reading email address due to GDPR compliance. In Jira portal for every user attribute there is a visibility to control who can see. For example

image
image733×398 19.8 KB

So before questioning the connector, I thought of checking the response in API first.

When I change the visibility to Anyone then I can see email address in API response and in ISC as well. For the remaining 2 options I don’t get the email.

But for my teammate account who is registered as site admin, though the account email has only you and admins, I can see the email.

When we connected with Jira support, below is the response.

The API endpoint that you shared earlier seems to be correct. However, the user’s privacy controls are applicable to the API response.

I believe we don’t have a way to bypass this. These privacy controls were added due to GDPR compliance, and therefore the users should have control over who can view their personal details.

API I am using to read user data
for a single user: GET https://odido.atlassian.net/rest/api/3/user/?accountId=<618e5>
for all users: GET https://odido.atlassian.net/rest/api/3/users

Then we found a way to get all users with all the data using search API
POST https://api.atlassian.com/admin/v1/orgs/:orgId/users/search

When I search in google, I find a new API every time. Every API call is missing one or the other attribute, so no API is perfect to use.

I don’t wanna use these APIs when I have OOTB connector.

In connector documentation, I see the below info

image
image992×73 3.12 KB

Our accounts are already managed accounts and verified the domain as well.

I am posting this here to see if you have faced these issues or to know your experience in it.

Thanks
Krish

2

We have run into the emailAddress issue too. We haven’t found a consistant way to pull in that information.

Currently we are utilizing 2 separate connections into Atlassian. We use the OOTB connector for provisioning. Then we have a separate Web Services connection (utilizing https://api.atlassian.com APIs) to modify Extended Profile information (Department, Job_Title, Location, etc). We also get the Last_Active data from the Web Services connection.

We would prefer to only have one connection, and have thought about writting a custom SAAS connection to combine our two connections.

Our biggest complaint has been the lack of remote provisioning options for BitBucket. Atlassian is supposed to be fixing that this year.

3

Thanks @Carlatto for sharing your experience. That makes two of us now :slight_smile:

Which API you are using to read user data with email address.