After changing my password, I cannot push to my repo without being required to solve a CAPTCHA

Matthew Moisen

Hi Bitbucket team,

I had to change my password at work as per the password policy. Since that time, virtually every time I try to push to a repo hosted on my company's Bitbucket server, I receive this error:

Your Bitbucket account has been locked. To unlock it and log in again you must
solve a CAPTCHA. This is typically caused by too many attempts to login with an
incorrect password. The account lock prevents your SCM client from accessing
Bitbucket and its mirrors until it is solved, even if you enter your password
correctly.

If you are currently logged in to Bitbucket via a browser you may need to
logout and then log back in in order to solve the CAPTCHA.

I then have to log into Bitbucket and solve the CAPTCHA. I can push again within a minute on the same repo and not have to enter the CAPTCHA. If I wait longer than a minute, or if I immediately switch to a different repo and push, I will have to solve the CAPTCHA again.

I can however go to the Bitbucket web page, and repeatedly log out and log in without having to solve any CAPTCHA. Its always happens after attempting to push to a repo.

I've already made sure to change my git's password with

git config --global credential.helper wincred

And I can confirm that it is using the correct password with

git credential fill

protocol=https

host=gitscm.mycompany.com

So I don't understand what could be causing this.

I have seen that other people have complained about this issue.

https://answers.atlassian.com/questions/274173

https://answers.atlassian.com/questions/259633

Any ideas on how to fix this?

Best regards,

Matthew

 

Michael Heemskerk

Hi Matthew,

Could it be that you have either a script or a build job that is using your old credentials? One thing you could do is have a look (or ask your admin to have a look) at Bitbucket's audit logs to see which IP is triggering the authentication failures for your user. You can find them in BITBUCKET_HOME/log/audit/.

An authentication failure would be logged as follows:

0:0:0:0:0:0:0:1 | AuthenticationFailureEvent | admin | 1474293778897 | admin | {"authentication-method":"basic","error":"Invalid username or password."} | @10IA6L8x962x13x0 | -
0:0:0:0:0:0:0:1 | AuthenticationFailureEvent | admin | 1474293800985 | admin | {"authentication-method":"basic","error":"Invalid username or password."} | @10IA6L8x963x18x0 | -
0:0:0:0:0:0:0:1 | AuthenticationFailureEvent | admin | 1474293802155 | admin | {"authentication-method":"basic","error":"Invalid username or password."} | @10IA6L8x963x22x0 | -
0:0:0:0:0:0:0:1 | AuthenticationFailureEvent | admin | 1474293819180 | admin | {"authentication-method":"basic","error":"Invalid username or password."} | @10IA6L8x963x26x0 | -

This is from testing from localhost (hence 0:0:0:0:0:0:0:1) with the user 'admin'.