Is it possible to authenticate with kerberos for the http requests Jira makes to itself?

dmitri November 29, 2016

We encountered https://confluence.atlassian.com/jirakb/how-to-fix-gadget-titles-showing-as-__msg_gadget-813697086.html and noticed that the requests JIRA makes to itself are not authenticated with Kerberos. We tried adding some things to the file specified with the property:

java.security.auth.login.config

We have:

com.sun.security.jgss.login {
    com.sun.security.auth.module.GssLoginModule required client=TRUE initiate=true;
};
com.sun.security.jgss.initiate {
    com.sun.security.auth.module.GssLoginModule required client=TRUE initiate=true;
};
com.sun.security.jgss.accept {
    com.sun.security.auth.module.GssLoginModule required client=TRUE accept=true;
};
com.sun.security.jgss.krb5.initiate {
    com.sun.security.auth.module.GssLoginModule required client=TRUE initiate=true;
};
com.sun.security.jgss.krb5.accept {
    com.sun.security.auth.module.GssLoginModule required client=TRUE accept=true;
};
krbLogin{
    com.sun.security.auth.module.GssLoginModule required doNotPrompt=false debug=true useTicketCache=false;
};

We do have Kerberos authentication working to our database via this section of that file:

SQLJDBCDriver {
    com.sun.security.auth.module.GssLoginModule required initiate=true;
};

What configuration can we add to make the http requests authenticate?

2 answers

Comments for this post are closed

Community moderators have prevented the ability to post new answers.

Post a new question

0 votes
Gonchik Tsymzhitov
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
January 21, 2021

How about the Marketplace addons  ? 

As I see they cover request

0 votes
dmitri December 5, 2016

Alternatively, could we change the hostname and port for this request to be something other than the baseUrl of jira? (e.g. localhost)?