nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How can I troubleshoot bitbucket OAuth authentication permission issues via jenkins?

Dave Wolff

Our team has had the Jenkins Bitbucket OAuth plugin working great for years. This morning, with no changes to the Jenkins server as far as I can tell, I am unable to access Jenkins. I am able to authenticate to jenkins, but it tells me that my account "is missing the Overall/Read permission".

Other members of my team do not receive this error message even though we have the same permissions set up in Bitbucket. The authorization configuration on jenkins has not changed and it appears to be correct. My suspicion is that something has gone haywire with Bitbucket's OAuth for my user account, but I have no way to discern if this is true.

Is there a way I can begin troubleshooting this issue to gain some insight as to if the failure is with Bitbucket OAuth? In particular:

If I can see what groups are being reported assigned to my user account, that would be a fabulous start.
If there is some documentation to determine how Bitbucket assigns groups to OAuth users, that would also be handy. In particular, how does a bitbucket user get assigned the "<team>::admin" "<team>::contributor" and "<team>::member" groups/roles via the Jenkins plugin? I don't know if this is related specifically to the jenkins Bitbucket OAuth plugin, or if it's something innate to Bitbucket and how it reports groups/permissions.

Thanks in advance,
Dave Wolff

Accepted answers

Dave Wolff

After much debugging, it appears that the Bitbucket API may have changed and the URL that the Jenkins Bitbucket OAuth plugin is using to get access to team memberships has been deprecated and has moved very recently?

The following URL is used by the plugin to access team roles:

https://api.bitbucket.org/2.0/teams?role=<admin|contributor|member>

When I invoke it using API credentials (not via OAuth), I receive an error pointing me to this page https://developer.atlassian.com/cloud/bitbucket/rest/api-group-teams/#api-teams-get which indicates that the endpoint is deprecated and has been removed.

This doesn't explain why my colleagues can still access the jenkins instance but I cannot. So it may be a misdiagnoses, but our varying success could also be explained by some level of caching, or maybe session expiration/refresh has occurred.

All comments

Dave Wolff

https://api.bitbucket.org/2.0/teams?role=<admin|contributor|member>

Dave Wolff

Adding further to the mystery. The other team members get a proper response from the https://api.bitbucket.org/2.0/teams?role=admin endpoint. So somehow it's just my account that is receiving the error/removed message.

Dave Wolff

So the correct analysis as far as I can tell is that I can authenticate to Jenkins via Bitbucket OAuth, but I receive zero permissions since my user account cannot get results from the following endpoint:

https://api.bitbucket.org/2.0/teams?role=<admin|contributor|member>

My team members all get viable results from the endpoint so it's truly perplexing why I am told that the endpoint has been moved.

Looks like we may be switching to Jenkins local user authentication again. If any bitbucket team member wants to chime in and explain why this might be happening, I'd appreciate it!

David Sweeney_761kci

Im experiencing the same issue at our company. Also started yesterday. Im able to authenticate via oAuth but group membership is not being passed back from the api.

Dave Wolff

I've opened a support ticket with Bitbucket to hopefully get a straight answer on the flaky API. I don't expect to hear anything positive though, so I've moved away from using the Bitbucket OAuth Plugin and we're using local Jenkins user accounts for now.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

bitbucket

bitbucket-cloud