Composer: multiple SSH Keys or oAuth not working on Bitbucket

[Pau Penin]

I'm on a tricky situation to manage the access to multiple private repositories from a server which I'm installing with Composer.

I have multiple Teams with Projects and Repositories and everything works great for me and my team for our daily work.

The problem is when I want to give access to certain Repositories or Teams for a certain machine (usually a Linux server). For example to install repositories with Composer.

I've tried different options but or I'm missing a point or I don't know how to solve properly:

SSH Key method:

I want to configure an SSH key for multiple Repositories or multiple Teams but not on Account level for not giving access to all Repositories and Teams I have access.

The problem is that I cannot use the same SSH Key on multiple Repositories or Teams because of "Someone has already added that SSH key." error.

oAuth option:

I tried to create oAuth key/secret consumers and they work good if I generate an access_token with cURL and clone the repositories with x-token-auth pattern.

I can't make them work with composer unless if I configure the x-token-auth for repository url on composer.json which is not an option for obvious reasons.

I already tried to create auth.json file and configure bitbucket-oauth on composer.json

User based:

The only option I see would be to create a user for each server and configure and SSH key to this user and grant access to these repositories. Seems very time consuming and non scalable solutions.

Could anyone give me any insights about this problem?

Thank you in advance!

[Lenin Raj]

Hi @Pau Penin 

You can generate multiple SSH keys for the same user with different IDs. And add the different SSH keys for appropriate repos.

While cloning the repo, just change the host name to the one for which you want to use the SSH key.

More details in https://confluence.atlassian.com/bitbucket/set-up-additional-ssh-keys-271943168.html

[Pau Penin]

Thanks @Lenin Raj

Yes, the other option I forgot to mention is to generate a ~/.ssh/config file and change each of the hostnames on composer.json to configure different SSH Keys

Example:
git@bitbucket-repository-1:my-team/my-repository.git
git@bitbucket-repository-2:my-team/my-repository-2.git
git@bitbucket-repository-3:my-team/my-repository-3.git

This solution is not very comfortable since you have to configure this file for each machine (we are 3 members on the team + multiple servers) and if you want to give access to multiple repositories you have to create and configure an SSH Key for each of them.

For example on one project I have 8 private repositories with 3 users and 1 server. Thats 8x4 = 32 SSH Keys to generate.

Other GIT providers like GitLab lets you add an SSH and shared it with multiple repositories and projects.

If this is the only workaround I may have to change which is a pitty because I have a great opinion of Atlassian products.

[Lenin Raj]

Hi @Pau Penin 

I understand your concern. The reason Bitbucket doesn't allow the same SSH key to be used in multiple accounts is because of security issues.

This restriction prevents anyone else from using your SSH key if it was ever leaked. I believe even Github has this restriction.

Why does your linux server cannot access all repositories? Is this a shared server?

[Pau Penin]

Thank you very much for your time @Lenin Raj 

Yes, is a customer server and as far I don't know who has access to this server I don't want to give them access to all repositories on my account or all repositories of the teams.