Configuring authentication for an application link is essentially defining the level of trust between Confluence and the application that it is linked to. On this page:

Choosing Authentication for an Application Link

The level of authentication that you should configure for your application link depends on a number of factors.

• Do the two applications you are linking trust each other? i.e. are you sure that the code in the application will behave itself at all times and that the application will maintain the security of its private key?
• Do the two applications you are linking share the same user base or not?
• Do you have administrative access to the application you are linking to?

Common scenarios include:

• If the two applications you are linking trust each other and share the same user base, configure two-way authentication using Trusted Applications for both incoming and outgoing authentication. For example, you may link your internal Confluence server to an internal JIRA server.
• If the two applications you are linking trust each other but do not share the same user base, configure two-way authentication using OAuth for both incoming and outgoing authentication. For example, you may link your internal Confluence server to an external (customer-facing) JIRA server.
• If you do not have administrative rights to the application that you are linking to (e.g. linking to a public FishEye server), configure a one-way outgoing link authenticated using basic HTTP authentication or do not configure any authentication for the link. For example, you may link your external Confluence server to a partner organisation's Confluence server. An unauthenticated link will still allow the local application to render hyperlinks to the remote application or query anonymously-accessible APIs.

The flowchart below provides a guide to what authentication you should configure for your application link.

Read the following topics for information on how to configure authentication for an application link:

Flowchart above: Determining what authentication to configure for an Application Link

Security Implications for each Authentication Type

If you configure Trusted Applications authentication for your application (i.e. your servers have the same set of users and they fully trust each other), please be aware of the following security implications:

If you configure OAuth authentication for your application (i.e. your servers have different sets of users and they fully trust each other), please be aware of the following security implications:

Screenshot above: Configuring authentication during application link setup

About Primary Authentication Types

About Impersonating and Non-Impersonating Authentication Types