git bitbucket unauthorized
Asked by Livio Patavini:

Hello!

yesterday or in any case in the past few days we encountered authentication problems from our jenkins application towards the git repository managed by bitbucket (of which the log I report). Since we have never changed our login credentials, we wonder if by any chance you have had any disruption that could have impacted git authentication.

Thanks

```
Attempting to resolve master from remote references... > git --version # timeout=10 > git --version # 'git version 2.20.2'using GIT_ASKPASS to set credentials Bitbucket > git ls-remote -h -- https://bitbucket.org/soldotech/jenkins-pipeline/ # timeout=10ERROR: Checkout failedhudson.plugins.git.GitException: Command "git ls-remote -h -- https://bitbucket.org/soldotech/jenkins-pipeline/" returned status code 128:stdout: stderr: remote: Because your Atlassian account admin requires single sign-on, you'll need to authenticate with an app password. Create an app password at https://bitbucket.org/account/admin/app-passwordsfatal: unable to access 'https://bitbucket.org/soldotech/jenkins-pipeline/': The requested URL returned error: 403	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2450)	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:2051)	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1951)	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1942)	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.getRemoteReferences(CliGitAPIImpl.java:3381)	at jenkins.plugins.git.AbstractGitSCMSource.retrieve(AbstractGitSCMSource.java:838)	at jenkins.scm.api.SCMSource.fetch(SCMSource.java:636)
```


Answers:
author: Theodora Boudale
body: Hi Livio,

Did you recently verify a domain for your organization as per <https://confluence.atlassian.com/cloud/verify-a-domain-for-your-organization-873871234.html> ?

Checking in our system, I can see that the Bitbucket account with same email as your Community account is a managed account.

When a domain is verified as per the documentation above, all Atlassian accounts with an email from this domain become managed.

If you have a managed account, HTTPS authentication when cloning/pulling from Bitbucket Cloud repos is no longer possible with a password, and an app-password should be generated and used instead.

If this started occurring the last few days, I would assume that it was because you verified the domain.

You can create an app-password for the Bitbucket Cloud account that you use for authentication in Jenkins as per the following documentation:

* <https://support.atlassian.com/bitbucket-cloud/docs/app-passwords/>

and use this app-password in Jenkins, instead of the account's password.

Please feel free to let me know if this works for you and if you have any questions.

Kind regards,  
Theodora

comments: author: Livio Patavini
body: hello!

thanks for the answare. I'm still using an app password generated from mine atlassian account (**lpatavini@soldo.com**). Another strange thing is that the problem is not persistent but intermittent (about 1 time each 10 tries).

What could be? Could you make a search from server side logs? I have a case of error just from few minutes ago:

```
 > git ls-remote -h -- https://bitbucket.org/soldotech/jenkins-pipeline/ # timeout=10ERROR: Checkout failedhudson.plugins.git.GitException: Command "git ls-remote -h -- https://bitbucket.org/soldotech/jenkins-pipeline/" returned status code 128:stdout: stderr: remote: Because your Atlassian account admin requires single sign-on, you'll need to authenticate with an app password. Create an app password at https://bitbucket.org/account/admin/app-passwordsfatal: unable to access 'https://bitbucket.org/soldotech/jenkins-pipeline/': The requested URL returned error: 403
?
```

job launched [17-nov-2020 9.26](http://px-dev-tools.px.iefcloud.com:8080/job/soldo-store-service/job/hotfix%252F3.5.1/1/).


author: Livio Patavini
body: ![Screenshot at Nov 17 18-01-28.png](https://community.atlassian.com/t5/image/serverpage/image-id/118671iA17B8256237452AF/image-size/large?v=v2&px=999 "Screenshot at Nov 17 18-01-28.png")here i'm using the app password in place of normal login password.


author: Theodora Boudale
body: Hi Livio,

Thank you for the info!

If this issue occurs intermittently, I believe the most likely reason would be a cached password in a Git credential manager on that machine. Checking our logs, I can also see intermittent 403 errors and I also see several requests where a password is used instead of an app-password.

Could you please let me know:

* What operating system do you have on the machine where Jenkins is running?
* Do you use another Git client application on the same machine, e.g. SourceTree or something else?
* Or do you perform Git operations via HTTPS via terminal/Git Bash from that machine?

Kind regards,  
Theodora


Tags: bitbucket-cloud