nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Marking call to BB from my Connect app

Alex Dess_xuckgl

Context

I'm building a BB Cloud Connect app. The app installs correctly, as in it receives tenant data such as ClientKey and SharedSecrect.

I'm now trying to have my app make API calls to BB on behalf of the tenant.

I started off with a proper, real-life implementation. But have now paired things back to a barebones example.

Steps to reproduce what I've done

When my app is installed I save the following details
- key
- clientKey
- sharedSecret
I then use the following code to generate a JWT bearer token using the above data:

import * as jwt from "atlassian-jwt";
import moment from "moment";

const requestMethod = "GET"
const requestUrl = "https://api.bitbucket.org/2.0/repositories/XXX/?page=1&pagelen=100"
const key = "XXX"
const clientKey = "XXX"
const sharedSecret = "XXX"

const now = moment().utc();

const req: jwt.Request = jwt.fromMethodAndUrl(requestMethod, requestUrl);

const tokenData = {
"iss": key,
    "iat": now.unix(),
    "exp": now.add(30, 'minutes').unix(),
    "qsh": jwt.createQueryStringHash(req),
    "sub": clientKey
};

console.log(jwt.encode(tokenData, sharedSecret));

I then use the token generated in Postman to make a call to BB

Expected outcome

A list of repositories owned by the account, which is what I see when I make a call using Postman using basic auth and a BB app password:

Actual outcome

A 200 response but an empty values array:

Accepted answers

Alex Dess_xuckgl

Worked it out. There were 2 problems:

Despite what the docs say it appears as if you cannot submit the JWT token in the query string. It has to be in the header. I've informed BB support of this.
When you select Authorisation type as "Bearer Token" in Postman:

the "Authorization" header value is prefixed with "Bearer":

This needs to be "JWT".

After I made those 2 changes my GET request succeeded.

All comments

seanaty

Because accounts can have public repositories the response here can be confusing. This tells me that authentication is failing. You're only seeing the workspace's public repositories, which is, nothing .

To troubleshoot authentication you can try fetching an individual repository that is private.

As per why authentication is failing, I can't really see from your example anything that looks off. I would double check the claims in your JWT. Bitbucket can unfortunately be different from the rest of Atlassian. Here is the Bitbucket-specific documentation for JWT: https://developer.atlassian.com/cloud/bitbucket/understanding-jwt-for-apps/

It looks as if the `iss` claim also needs to be the clientKey (along with the `sub` claim).

Hope this helps!

Alex Dess_xuckgl

Thanks for your reply

It looks as if the `iss` claim also needs to be the clientKey (along with the `sub` claim).

I read the docs, it looks like from my reading fo that iss should be:

clientKey - BB calling app
key - app calling BB

I'm trying to the latter. But I tried out using clientKey just to see, but it didn't seem to make a difference. So I'm not sure that is id.

To troubleshoot authentication you can try fetching an individual repository that is private.

This was super helpful. I changed it to fetching a private repo as suggested and now I get a 404 - Access denied. You must have write or admin access.

So it definitely looks like a permission error and not an authentication one. That is supported by this screen that is shown when the app is installed:

But this raises 2 questions:

Why does a GET request against a repo requires either write or admin permissions? Why not just read?
How do grant the app write or admin permissions? Note: Not desirable but may be helpful in understanding things.

Tackling the 1st question first, I looked at the docs for GET request against a specific repo (see docs):

So I should not in fact need write or admin.

Turning to the 2nd question, I've read through Security overview & Scopes for the Bitbucket Cloud REST API. I changed the app descriptor so that it now includes the scope "repository:admin". Now when the app is installed I see:

But I still get the same error when I make a call, 404 - Access denied. You must have write or admin access.

So I'm still at a bit of a loss as to what is wrong

Alex Dess_xuckgl

I tried one more thing. I performed 2 tests, both make calls via Postman using basic auth with an app password.

For the 1st call I used an app password with these permissions:

The call was successful.

For the 2nd call I used an app password with these permissions:

This was the most permissive I could be, without granting read on repositories.

The call failed, as expected. But with this error message:

Note exactly sure what that means for my problem. But thought I would share incase someone smarter than I knows

seanaty

Access denied. You must have write or admin access.

This is also the default when you request a private repository anonymously. Something is still misconfigured with how you're making the request it seems.

The scopes for your application are correct.

Alex Dess_xuckgl

Worked it out. There were 2 problems:

Despite what the docs say it appears as if you cannot submit the JWT token in the query string. It has to be in the header. I've informed BB support of this.
When you select Authorisation type as "Bearer Token" in Postman:

the "Authorization" header value is prefixed with "Bearer":

This needs to be "JWT".

After I made those 2 changes my GET request succeeded.

seanaty

Nicely done. I've submitted and update to the docs and it should be deployed soon-ish.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

bitbucket

bitbucket-cloud

connect