問題

Users who are registered in Jira's user base (show up under Administration > User management > Users) but are not granted application access, are unable to create issues through the Mail Handler, even if the Default Reporter is set.

Specific to this issue:

• Users with permission to access the Jira application (through a Jira license) and create issues in the project (via the Project Permission configuration) do not have a problem creating issues using the same mail handler;
• The Mail Handler is a Jira Mail Handler (documented in Creating issues and comments from email) and not a Jira Service Management Mail Handler which is a different mail handler functionality (documented in Receiving requests by email)

The following warning appears in the file atlassian-jira-incoming-mail.log

2022-07-02 11:21:32,750+0200 WARN [GMAIL] Caesium-1-1 anonymous    GMAIL TEST GMAIL TEST[10100]: Cannot create issue due to invalid license: [Sorry, you can't create any issues right now, as you need to have access to a Jira application to be able to create issues. To gain application access you need to be a member of a group assigned to an application.]

環境

• Jira Server / Data Center 7.0.0 and above

原因

Case where the Jira Mail Handler is NOT configured with a user set in the Default Reporter field

In such case, when a new incoming mail is processed by the Jira mail handler, it will check if there is a user associated to the email address of the sender of the email. If it maps the email address to a user who does not have Jira application access, the email will not be processed, and the "invalid license" warning will be thrown in the logs. This scenario is listed in this KB article as Root Cause1.

Root Cause 1

• The Jira Mail Handler is not configured with a Default Reporter
• The email address of the sender of the email matches the one of an existing Jira user
• This user does not have Jira application access

Case where the Jira Mail Handler is configured with a user set in the Default Reporter field

If the Jira Mail Handler is configured with a Default Reporter, the Mail Handler will behave as described below.

When a new incoming mail is processed by the Jira mail handler, it will first check if there is a user associated to the email address of the sender of the email. Depending on the result of this check, either of the 2 scenarios below will happen:

• if the mail handler maps the email address to an existing Jira user:
  • the Default Reporter setting will be ignored, and the mail handler will try to create a Jira ticket (or comment) from this email on behalf of the user mapped to the email address
  • if this user does not have Jira application access, the mail handler will fail to create the ticket (or comment) from this email and the "invalid license" warning will be thrown in the logs
  • this behavior is reported as a bug in the ticket JRASERVER-63285 - Getting issue details... STATUS and is listed in this article as Root Cause 2 
• if the mail handler can't map the email address to any existing Jira user:
  • the mail handler will try to create a new issue by using the Default Reporter, as long as the default reporter:
  • has application access (via a Jira license)
  • has the permission to create issues within the project associated to the mail handler
  • If the user set as the Default Reporter does not have Jira application access, the mail handler will fail to create the ticket (or comment) from this email and the "invalid license" warning will be thrown in the logs. This behavior is listed in this article as Root Cause 3 

Root Cause 2

• The Jira Mail Handler is configured with a Default Reporter
• The email address of the sender of the email matches the one of an existing Jira user, which is not the one defined in Default Reporter
• This user does not have Jira application access

Root Cause 3

• The Jira Mail Handler is configured with a Default Reporter
• The email address of the sender of the email does not match the one of an existing Jira user
• The user set as the Default Reporter does not have Jira application access

Diagnostic Steps

• First, check the configuration of the mail handler to see the Default Reporter is set or not
• Review the file atlassian-jira-incoming-mail.log and check if the "invalid license" warning is thrown
• Note that the warning does not show the sender of the email, and therefore does not allow to know which Jira user actually triggered it. To determine which user caused that warning and needs to be granted Jira application access, you can follow the steps below:
  1. Jira 管理者としてログインします。
  2. Go to ⚙ > System > Logging and Profiling
  3. Click on Enable on incoming mail logging, then underneath that, click Enable Debugging. This configuration will add more debugging information to the file atlassian-jira-incoming-mail.log
  4. Note that the problematic email should still be marked as UNREAD in the mailbox. This is because Jira does not mark as READ incoming emails that failed to be processed due to the license issue. Therefore, all you have to due is to wait for a few minutes to give time for the mail handler to try to fetch and process again the problematic email

  5. After that, check again the file atlassian-jira-incoming-mail.log. You should see that now new rows with DEBUG are included. Look for the warning about the license. Once you find it, check a few rows above it to see if you can find some DEBUG line like the one below:

     2022-07-02 11:21:32,340+0200 DEBUG [GMAIL] Caesium-1-1 anonymous    GMAIL TEST Return-Path: <someuser@test.com>

  6. If you find the row above, this row should include the email address of the user that triggered the license warning
  7. Go to ⚙ > User Management > Users, look for this email address and check if there a user associated to it
  8. If you can see the user and if this user is not granted application access (the Applications column is empty for this user), then this KB article is relevant and you can move to the Resolution section 
• 3 possible scenarios:
  • If the Default Reporter setting is not set, then you are facing Root Cause 1 and you can move on to Resolution for Root Cause 1
  • If the Default Reporter setting is set
    • If the sender of the email address (found in the DEBUG logs) matches an existing Jira user, then you are facing Root Cause 2 and you can move on to Resolution for Root Cause 2
    • If the sender of the email address (found in the DEBUG logs) does not match an existing Jira user, then you are facing Root Cause 3 and you can move on to Resolution for Root Cause 3

ソリューション

Resolution for Root Cause 1

Grant the impacted user application access to Jira (which will require a Jira license).

If you cannot grant application access to the impacted user because this user is a customer who does not need to log into the Jira application, then you will need to use  a different type of mail handler than the Jira Mail Handler. Instead, you should use the Jira Service Management (JSM) Mail Handler which is documented in Receiving requests by email). This mail handler:

• requires the JSM application to be installed in your Jira instance
• can only be configured with JSM projects
• does not require users (customers) to have a Jira license to raise tickets via incoming mail

Resolution for Root Cause 2

• Grant the impacted user application access to Jira (which will require a Jira license)
• If you want the user set as the Default Reporter to create issues from the incoming email instead of the actual sender of the email, you need to make sure that this sender's email address does not exist in Jira's user base. To ensure that, what you can do is go to the page ⚙ > User Management > Users, search for that email address and either delete the user associated to this email address, or change the email address of this user to a dummy one

Resolution for Root Cause 3

Grant the user set as the Default Reporter application access to Jira (which will require a Jira license).