REST Session from username/password?

[Denise Skidmore]

I have a working python script that automatically adds/resolves comments/tasks to our PRs.  I authenticate thusly:

import os

from oauthlib.oauth2 import BackendApplicationClient

from requests_oauthlib import OAuth2Session

from requests.auth import HTTPBasicAuth

...

    client_secret = os.environ['lint_client_secret']

    client_id = os.environ['lint_client_id']

    client = BackendApplicationClient(client_id=client_id)

    oauth_session = OAuth2Session(client=client)

    _ = oauth_session.fetch_token(

        token_url=OAUTH2_TOKEN_URL,

        auth=HTTPBasicAuth(client_id, client_secret), timeout=300)

I don't want to store my client secret locally, but I would like to be able to test my script locally, so I'd like to have an interactive mode that takes the username and password from prompts when the bitbucket environment variables are missing.

https://developer.atlassian.com/cloud/bitbucket/authentication-for-apps/  Doesn't list a grant type that takes username and password.  How should I get a request.Session object that logs in with username and password and uses the user's permissions?  (I am an admin of my workspace, I expect all REST calls to be valid as my user unless specifically prohibited by merge restriction.)

[Hariharan Iyer]

Hi @Denise Skidmore ,

If you're accessing bitbucket via a python script, you might consider using access tokens or app passwords as described here - https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication

HTH!

~ Hariharan

[Denise Skidmore]

App passwords are still secrets the local user may not have.  I'm looking for a way for someone to log in with their normal password or maybe the SSL connection that already exists for push/pull activity, not an app specific password.

[Jim Knepley - ReleaseTEAM]

To your first question: I like using the getpass library to get things like credentials:

client_secret = os.environ.get('lint_client_secret', getpass.getpass())

...but you could also use use input() or the readline library if you want to get fancy.

Regarding your second question: I suspect you'd need to use a custom authentication handler to add the JWT bearer token to a request.

[Denise Skidmore]

This extra step has not seemed necessary.  The values stored in "secured" environment variables are read by the script just fine.  The automated script that runs on the server runs just fine.  I'm looking at ways to modify the auth when running it on a dev machine that doesn't have those OS variables.