Best Practices in Jira Administration – API Tokens
One of Jira’s strengths is that it allows 3rd party integration via REST API calls. By providing the username, password and Base URL, it is possible to 3rd party apps to query or update Jira automatically.
In this article, we will share why using API Tokens is a better and safer option than using Password Authentication.
The Power of Passwords
Besides entering passwords on the Jira login screen, it is also possible to provide the passwords on 3rd party applications or scripts to execute REST API calls.
Some of the use cases are like
- Create issues from Slack
- Send alerts to Microsoft Teams
- Update Jira issues with Commits information from GitHub
- Integrate with your in-house systems
If the password fails in the wrong hands, it is possible that
- Wikileaks of your confidential data
- Your Jira system can slow down drastically due to excessive API calls which affects the usage of other users
Benefits of using API Tokens over Passwords
By using API Token, it improves the security of your Jira instance
- Safer – The API Token has a certain level of password complexity which defends against dictionary attacks
- Isolation – It distributes the risk by having a different API token for each 3rd party integration. It is possible to revoke/reset the token for that application without any impact to other applications.
- Differentiation – With a different mechanism, it is possible to apply more stringent checks on the usage of API Tokens (e.g. restriction by IP address range)
- Control – It restricts ordinary users from using their credentials to do REST API calls
- Availability – For sites running on Single Sign On. Users will not know their passwords other than their Windows passwords
- Validity – It is possible to set the expiry date of the token
API Token Authentication for Jira
We like the API Token Authentication Jira because it offers the following features:
Disable basic authentication with user passwords
It allows basic authentication with API Tokens. Currently, it is not possible to use the Jira Data Center’s Personal Access Token together with the username on 3rd party websites.
Warning: If you disable Basic Authentication with passwords in the System Wide settings, you also can’t authenticate on non REST endpoints with API Tokens directly. You can still do that by reusing a session you got from authenticating with an API Token.
Able to limit usage to particular IP ranges
It is possible to limit the usage of the API token to the IP address of the internal system. You can ensure the REST API calls are coming from your trusted network.
Block requests with malicious characters in path
This is a bonus feature which helps to defend against some attack vectors.
Limit usage of API Tokens
It is a security best practice to grant rights only to users who needs it and has proper training. There are incidents arising from users who entered their Jira passwords on 3rd party sites or executed a buggy script.
Tip: We recommend to create a group “jira-api-users” to manage those service account users who can use API Tokens.
Set a validity of the API Token
If the token is for testing or for temporary usage, the Jira admin can just set a shorter validity that will expire automatically. Otherwise it relies on the Jira Admins to remember to revoke the access manually.
Service Accounts typically do not have a password validity. If the service account is from an Active Directory, there could be disruption if there is a 90 day reset password policy.
By using the Active Directory passwords, it is possible that account is locked out of all applications after multiple wrong password attempts.
Control over audit logging
It offers admins a fine level of control over the information to be logged.(more…)
Share this post
7 Things You need to Know about Automation for Jira
Automation for Jira is one of the most popular apps on Jira. The app allows users to automate and extend Jira with no coding required. Being very user-friendly, there are a lot of admins who can dive straight into using the tool without reading the user guide. As part of our Best Practices series, we have summarised the key things you need to know in this blog post.
For those who are new to Automation for Jira, you can check out this YouTube video below for an introduction.
Things you need to know
1) Asynchronous processing
To speed up on the response time, the Automation for Jira plugin will add all updated issues into a queue. Although there are 8 background threads to process the requests, it still does not ensure the issue are processed immediately. Therefore, users will need to refresh the issue to view the changes applied by the automation rule.
It is possible to select synchronous execution of the rule but that will have some impact in the performance.
2) Rule Matching/Execution
Whenever an issue is updated, the issue is matched against all the configured automation rules (global + project) . As a result, when there are a lot of automation rules, it takes time to
- to check against each individual automation rule
- to execute against each matching automation rule
Hence it is important to reduce the number of global automation rules by setting them as single project rules whenever possible. You should try to optimise the rules with more specific requirements.
If you are seeing a lot of No Actions Performed in the rule’s audit log, then there might be chance for optimising the rule
The powerful app allows multiple rules to update an issue due to a single triggered event. As a result, it may not be direct to identify the problematic rule. Moreover, if multiple rules are chained together without proper planning, it could lead to “spaghetti code” scenarios which is not easy to troubleshoot.
If the update is via workflow post functions, it would be easier to identify the bug.
4) Performance & Runtime
To cater to the flexibility and power of the Automation for Jira plugin, there are some tradeoffs. One of them is the processing time for automation rules is slower than post functions. For example, a simple assignment rule can take up to 3s to complete.
We have encountered some rules that can take up over 10 seconds to be processed. So you should check the audit logs on the performance of the rules.
5) Service Limits
Not a lot of users are aware of the Service Limits which can affect the execution of the automation rules. Some of the common service limits are listed in the table below:
When any of the limits is breached, the rules will be throttled until the limits are not exceeded. This could result in some unexpected behaviours as the issues are not processed during this period.
The likelihood of throttling is increased when a huge number of issues are created via REST API or Test Automation plugins.
The app maintains an audit log of the rule executions. Over time, the audit logs can build up which impacts your Jira database performance and clogging up your disk space.
We have encountered some sites which the retention period is set to the default value of forever.
It will be good to revise the retention period and set the schedule expiry during off-peak periods. For more info, check out this KB article.
7) Integration with other apps
Not a lot of people are aware that there are other apps which are compatible with Automation for Jira app. If you have these apps, you can use them with automation rules too.
- ScriptRunner for Jira – execute a ScriptRunner script
- Lookup Manager for Jira – update fields via a Lookup Table
- Better PDF Automation for Jira – export/email PDF documents
- Better Excel Automation for Jira – export/email custom Excel spreadsheets
- Better DevOps Automation for Jira – provides development-oriented triggers and automation
- Elements Connect for Jira – set Elements Connect field value
- Try to scope the rules within the project if possible. Use global rules only when necessary.
- Make sure your Jira project administrators know what they are doing. You can consider restricting the rights to trained project administrators (e.g. jira-power-admins group)
- Read up on Knowledge base and blog posts
- Conduct periodic audits. You can view performance Insights to see if there is any issues
Automation for Jira is a very useful feature. However, there is a likelihood to see everything as a nail when you have a hammer in your hand. This can result in performance issues in time to come.
We will need to understand what is the requirements and the underlying approach used by various apps. For certain scenarios, we feel it is better to use post functions with apps like
Hopefully, with these knowledge, Jira admins can apply Automation for Jira effectively.
Share this post
How to make Jira Dashboards faster
We have identified Jira Dashboards can be a potential bottleneck while helping our customer to tune the performance of their Jira. This article explains why Jira takes longer time and give some tips on how to speed things up.
Why my Jira Dashboard takes a long time to load?
These are some factors that contributes to the slowness of Jira:
- Huge number of gadgets within a single dashboard
- Gadgets with complex reporting
- Filters with a huge number of issues
Huge number of gadgets
It will be faster if you focused doing 1 task at a time versus doing 100 tasks concurrently. By the same principle, your dashboard will load faster if Jira has less requests to work on at the same time.
Jira helps with a default maximum limit of 20 gadgets within a dashboard. However, it is possible to modify the limits on the number of gadgets on a dashboard.
When there are way too many requests
We have a couple of support tickets which the end users added a lot of Gauge Gadgets in their dashboard. As a result, some gadgets on the dashboards cannot load.
This is because the browser will silently throw the error message Failed to load resource: net::ERR_INSUFFICIENT_RESOURCES if it detects that are way too many requests within a short interval.
To support the users, we introduced Multiple Filters Counter Gadget that can display multiple counter within a single gadget.
Complex Reporting Gadgets
Not all Jira gadgets are the same. There are some gadgets which involves complex processing. For example, our Tissue for Jira app performs the handy task of traversing all the linked issues and extracting the various field values to present a tabular overview.
If you are using such complex reporting gadget, it will be advisable to have lesser gadgets within that dashboard.
Filters with many matching issues
It is likely that some dashboards load very fast when they were created initially. However, as the number of issues in the project increases over time, the performance of the dashboard become slower without the original author noticing.
This is because there are more issues to be processed. A useful tip will be to time-box your Jira filters within a time period using JQL date functions like startOfYear(), startOfMonth()
Alternatively, you can use our Rolling Window Monthly/Weekly Gadgets which only retrieve the matching issues in the last X weeks/months specified.
Other ways to load your Jira Dashboards faster
Add more computing power
The simplest way is to pump more computing resources like more CPU and memory. Jira Data Center also scales the performance by distributing the workload across more nodes.
Split into multiple dashboards
As mentioned previously in Best Practices in Jira Dashboard Reporting, it is recommended to keep a dashboard to its objectives to allow people to identify the action required.
But it is troublesome to have many dashboards
Beside adding the links to various dashboards as project shortcuts in your Jira project, you can also add links to related dashboards using our free Link Menu Gadget to facilitate navigation. You can also add links to the your Confluence spaces and other related project resources too.
If that is still not enough and you want to access your dashboards easily from everywhere in Jira. You can organise your Dashboards in cascading Dashboard Folders which can be accessible in the Jira top menu.
What is the performance of your Jira Dashboard?
You may want to do the 23 seconds test on your frequently used dashboards. If it is taking longer than that, you might want to tidy up your dashboards.
Share this post
Best Practices in Jira – Dashboard Reporting
Jira Dashboards is a very powerful feature if used correctly. In this article, we will share with you the common pitfalls as well as some best practices based on our experiences as an Atlassian Solution Partner.
Why people use Jira Dashboards
Dashboards can be from a macro perspective like % of project completion to micro level on the list of tasks with their statuses.
Some common use cases for Dashboards are:
- monitor the progress of the tasks
- track the KPIs and the health of the project
- highlighting important stuffs (e.g. SLA breach, bottlenecks, shortages) for action taking
- show progress to motivate the team
More organisations are preferring dashboards over reports because of the following reasons:
- live information – able to see the current status which is more accurate
- time saving – there is no need for someone to spend time to compile the weekly/monthly progress reports manually
- interactive – as compared to a chart image in a PPT/PDF
- allows drilling in – you can zoom into the details of the issue for more information
- self reinforcing – it encourages people to update their Jira issues regularly
Common pitfalls and recommendations
Security / Information Disclosure
From our Jira consulting experiences, there are a number of instances where the dashboards and filters are accessible by users without logging in.
Although Jira’s permission scheme will prevent public users from viewing the issues, it is still possible to disclose sensitive information which may not be meant for public eye.
You should check whether there is information disclosure by logging out of Jira and visiting the URLs
- Dashboards – https://<jira-base url>/secure/ManageFilters.jspa
- Filters – https://<jira-base url>/secure/ConfigurePortalPages.jspa
Unless the dashboards/filters are for public access, users should not select Public for the Add Shares option.
Tip: There is a “Sharing with anyone on the web” in Jira configuration which you can disable to remove the Public option if your Jira instance is not for public access.
Performance and utility
Another common pitfall is people tends to create 1 dashboard for each project and cramp everything inside. We have seen a dashboard with over 20 gadgets added. As a result, it clutters the dashboard and is slow because it has to load a lot of information. This can also slows down the Jira instance for other users.
From a design point of view, this is bad because it introduces a lot of noise in the dashboard. As a result, people cannot zoom into the important things that they need to take action from the dashboard.
A well designed dashboard should fulfil the following:
- Targeted for the role/purpose – A management report should not include the micro information like the list of tasks. Likewise a developer will be more concerned about the list of tasks he needs to work on. You can create different dashboards for different roles.
- Incite emotion or action – it should bring attention to the readers to take any necessary action. With correct use of colours and placement, users can determine the severity easily.
- Easy to understand – It should use the correct type of gadgets to present the information in the most direct manner. You can check out the list of Jira gadgets available on Atlassian Marketplace.
- Responsive – it should be fast to display the information without the reader having to scroll through many screens to read the entire page.
A dashboard is useful only when there are people using it. Another common pitfall we observed is that every user tends to build their own dashboards. While this is flexible, there are some disadvantages like:
- duplicated effort to create and maintain the dashboards
- decreased utility since only 1 person is using it
- some users are unaware on the types of gadgets available that they can use for reporting
- some users lack the proper training on how to write complex JQL queries and design good useful dashboards
- no standards on the performance metrics to monitor within the organisation
To tackle this, we advocate to design a set of dashboards as a template for every Jira project. When a new project is created,
- the set of dashboards and filters are also created based on the template
- The filters and dashboards are shared with the project so that people who have access to the project can access them
- Then the dashboards/filters are added to the Jira’s project shortcuts where all project members can access easily
- They can also be added to the Dashboard Folders and Menu Gadgets so that users can easily navigate to the reports
Another common problem that Jira admins face is obsolete dashboards/filters. By default, only the original creators can edit their dashboards/filters.
From Jira 7.12 onwards, it is possible to grant permissions for other team members to edit filters/dashboards. Hence a useful tip after creating a filter/dashboard will be granting permissions to the associated project roles
- to grant view permission to all project members
- to grant edit permission to the project administrators
We also recommend to define a naming convention for filters and dashboards. E.g <Jira project key> – <purpose>.
This is especially helpful for users when they are searching for a filter when configuring the gadgets. For very large instances, you can find multiple filters with the same name while selecting a filter for a gadget.
It is possible to define aliases for dashboards and filters with Dashboard Folders and Menu Gadgets.
When a user adds a new dashboard themselves, the system dashboard will disappear.
Actually the System Dashboard is very important because it is tedious to go through the list of project dashboards.
The System Dashboard can complements by
- providing a consolidated view and highlight the important things that matters to the user
- as well as a landing point where the user can navigate to other places
In conclusion, here is a checklist that you can use:
- review the list of public dashboards/filters and decide whether to disable public sharing
- set editing permissions for the shared dashboards
- define a set of dashboard templates for your Jira project
- define a naming convention for dashboards and filters
- install apps from the Marketplace that you identified that are useful
Check out Best Practices in Jira – Dashboard Reporting (Part 2) for the continuation of the writeup.
If you like this article, you might be interested to check out our best practices series
Share this post
Best Practices in Jira Administration – Be a Jira Hero ebook
This is an ebook on a collection of Jira best practices that Atlassian has gathered from Jira experts around the world.
The title “Be a Jira Hero – A guide for Admins, by Admins” is well deserving. Therefore we recommend all Jira administrators and wannabes to read the 25 pages ebook.
Jira Best Practices ebook
The ebook is well-organised into different sections with short but clear snippets of wisdoms:
- How to keep Jira clean and simple for your users
- How to use issues effectively
- Best practices on managing Custom Fields and Screens
- Things to consider when building workflows
- Tips on managing backlog in Jira
- How to get people to work on the issues
- Best practices on designing the Jira dashboards for even more effective reporting
- Shortcuts & Hacks to work faster with Jira
- How to make use of automation to make life easier
One Common Mistake
For example, the book has highlighted in Tip #20 to incorporate Resolution into the workflows. We observed that a number of Jira admins who did not have formal training tends do not understand the concept of resolution. Consequently, they overlook this important step while creating new workflows. While the Jira appears to be working, the implications are some built-in reports may be inaccurate and an important piece of information is missing.
Our Additional Jira Tip
Dashboards are very useful if they are used correctly. Team members can have visibility on the progress and be reminded on the outstanding tasks. Furthermore, Management can have clear visibility without spending a lot of time preparing routine reports. As a result, users will understand the value of updating their tasks in Jira.
To sum up, if you are a Jira administrator, you should download the ebook and review whether you have been applying the Jira best practices.
There is no need to provide any email address to download the book. To add on, you may also want to check out the following resources:
Share this post
Best Practices in Jira Administration – Jira Apps Management
This is a “lengthy” guide on the best practices on choosing and managing a Jira app. Coming from our years of experience as an Atlassian Solution Partner, it covers
- How to evaluate a Jira app
- How to better manage the apps installed in your Jira instance
- Things that Jira administrators need to watch out
Jira Apps from Atlassian Marketplace
By installing additional Jira apps, you can add new features to your Jira. For example, some of our popular Jira apps
- Attachment Checker for Jira – prevent users from uploading unauthorised or virus infected file attachments
- Multiple Filters Chart Gadgets – plot disjoint sets of data within a single chart or table
- Out of Office Assistant – reassign issues automatically when you are away
- Gauge Gadgets – useful gadgets for data visualisation on Jira dashboards
There are many more useful Jira apps available at the Atlassian Marketplace.
Evaluating a Jira App
Being an Atlassian Solution Partner, there are a number of criteria that we consider before recommending a Jira app to a customer. They are:
Fit to Purpose
The app should be able to address the requirements fully. It should be easy to use. The additional feature should not cause confusion to the existing users. We will also assess their design is robust and does not conflict other plugins or use cases.
Atlassian Marketplace Listing
It is very important to check out the app listing on Atlassian Marketplace. It contains a lot of useful informations like
- Rating and Reviews
- Number of Active Installations
- Vendor Accreditation
- Compatibility with the latest version of Jira
Rating and Reviews
While the rating and reviews do not mean much for a newly listed app, they do give insight of poor services or badly designed apps. Typically, users will flag out any issues that require attention. So, if there are no negative reviews, it is safe. And if there are a number of good reviews, then it is very safe.
Number of Active Installations
If an app is popular with a significant number of active installations, that is a good sign that the app is useful and functioning without major issues.
Atlassian has a Top Vendor program who has met the following requirements
- App traction – Their paid apps must attain at least 500 active installations
- Timely support – Has a Service Level Agreement (SLAs) and committed to provide at support for their users
- Support Website – Customers can raise support request easily via a website or email when necessary
- Vendor reliability – Atlassian conduct checks periodically to ensure they offer great customer experiences
For those exceptionally good ones, they are further recognised as Gold/Platinum Top Vendor.
If the app is only compatible with an older version of Jira, that is a big warning. You do not want to be left dangling helplessly for your next Jira upgrade.
Some apps are explicitly marked as unsupported. Unless you can accept the risks, it is better to avoid them.
Data Center Approved
Data Center approved apps are those that have passed Atlassian’s stringent criteria for use in Jira Data Center environments. As it takes considerable effort to become a Data Center Approved App. vendors will usually do that for their established apps. Therefore this is a plus point.
Although some users will usually dive in without reading the user guide, it helps when the documentation contains
- A quick overview of the functionalities
- Comprehensive writeup and how to use
- FAQs to facilitate on-boarding and best practices
- Up-to-date release notes
- An easy to navigate structure
Unless the app is really simple or open source, it is a risk to install an app with a one pager documentation.
Last but not least, the pricing of the app is also an important consideration. The app should have a reasonable pricing so that you will be assured of support for long term. It is also possible that you will upgrade to higher user tier or Data Center as Jira becomes an enterprise application. Hence the pricing for higher tiers should not exceed your budget.
For free apps, they should be from a credible publisher with significant number of installations. Otherwise, the publisher may withdraw support in near future.
Before Installing an App
Downloading the compatible version
There is a common mistake for Jira administrators who are unable to download the app via the Atlassian Universal Plugin Manager. The default download link on the Marketplace listing is for the latest version of Jira.
If you are not using the latest version of Jira, the correct steps to install/upgrade the app will be
- Click on the Versions tab
- Select See all … versions
- Hover on the topmost version which matches your Jira version
- Click on the Download link
- Upload the file via Atlassian Universal Plugin Manager in Jira
It is a best practice to install the Jira app on a Test environment first. It is not advisable to install an app directly onto the Production environment. This is because some apps may make changes to the database. Some changes are not be reversible when you uninstall the app later.
Maintaining a Change Log for the Apps
We usually advise our customers to create a Confluence page to track on the app installations, upgrades and uninstallation. This best practice helps to keep all the related information organised neatly on a single page.
The change log table can include the following information
- Date of Change
- Changed By
- Name of App
- Action Performed (e.g. install/upgrade/uninstall)
- From Version
- To Version
- Jira Issue Key
- Additional Notes
This will be useful especially when there are multiple Jira administrators who can perform changes. Although the audit log has a record of the changes, the default data retention period is only 90 days. It is also not that easier to read.
By using a Change Log, the administrator can link the change with a Jira issue and add notes. The Jira request helps to identify the user who raised the request to install the app together with the background context.
When there is an incident, the App Change Log will be useful to identify issues caused by app changes.
Things to watch out
It is not the end of the story after installing the app. There are a few useful tips for Jira administrators to watch out.
With more apps installed, it is likely that the memory footprint might increase over time. It will a best practice to check on the JVM memory utilisation from the System Information page after people start using the features. Likewise, CPU usage monitoring is also a best practice.
There are a handful of apps which will stop working without an active license. So be sure to renew your licenses before they expire to gain access to support and newer releases.
You can click on the Watch app link on the Marketplace listing. By doing so, Atlassian Marketplace will send you an email whenever there is a new version released.
Upgrading the Apps
As a best practice, it is important to upgrade regularly to get newer features, performance improvements and bug fixes. For security vulnerabilities, you should upgrade as soon as possible once you received a security advisory.
Although there is no need to schedule a maintenance downtime for installing/upgrading Jira apps, it is a best practice to do that during off-peak periods. During an app installation, there is a short interval where the Atlassian Universal Plugin Manager removes the old version and installs the newer version. You do not want any critical operations in between that period.
Also some apps may execute jobs during the upgrade to do some data crunching to support a new feature. Therefore, please read the release/upgrade notes for the app before you click on the upgrade button in Jira.
Share this post