Repository access is forbidden, but the SSH key authentication seems to succeed

[Vit_Brykner]

Hello, I recently joined a development team who use BitBucket as their git storage of choice. I created a new SSH key pair to be able to handle repository access without the need for constant password input, just like I was used to from GitHub in the past.

Having followed the BitBucket tutorial for the addition, the initial pull succeeded, and I was able to get the project up and running.

The next day, however, I noticed that the subsequent pull failed with the following error:

I was reassured from the team's side that nothing had changed in my access from the previous day, and so I started looking into this issue. The key was definitely present in the BitBucket UI logged in under the correct account, and the private counterpart existed on the laptop in the ssh folder.

I tried re-doing the SSH addition flow, this time using the GitHub tutorial I was used to from the past, which adds an ED25519 key, as opposed to a RSA one. Once again, the repository access operations worked without any issues, until today. I once again found out that the above mentioned error is present when attempting any pull or push operation.

I found your SSH troubleshooting page (https://support.atlassian.com/bitbucket-cloud/docs/troubleshoot-ssh-issues/), where, having gone through the steps, I haven't been able to notice anything out of the ordinary on my side compared to the examples. The SSH agent is running and has the work email key loaded inside. I tried killing and restarting the SSH agent without any effect on the issue.

Below is the current state as shown in the BitBucket UI, as well as the output of the verbose troubleshooting command.

Would you be able to identify where the problem lies knowing that on the day of creation the key works as expected, but not anymore the following day?

Thank you in advance for you assistance!

V.

[Theodora Boudale · Accepted solution]

Hi @Vit_Brykner,

Do you have multiple SSH key pairs locally? If so, it is possible that the SSH key offered by your client when you try to pull/push is different than the one added to your Bitbucket user.

If you have multiple SSH keys locally, my suggestion would be to:

1. First, check the content of each of the public keys to find out which one is uploaded to your Bitbucket user.

2. You can test if it's working by using the following command:

GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa" git pull

where ~/.ssh/id_rsa replace with the path and name of your private SSH key, whose public key is uploaded to your Bitbucket user.

3. When you identify the key and if the above command is working, you can add the following to the file named config in your ~/.ssh directory (if the file named config doesn't exist, you can create it):

Host bitbucket.org
    HostName bitbucket.org
    User YourBitbucketUsername
    PreferredAuthentications publickey
    IdentityFile /Users/YourUser/.ssh/my_ssh_key

Replace YourBitbucketUsername with your Bitbucket username and /Users/YourUser/.ssh/my_ssh_key with the path to the private key that is added to your Bitbucket user.

Then check if you can pull from the repo without using the environment variable GIT_SSH_COMMAND in the pull command.

Please feel free to let me know how it goes.

Kind regards,
Theodora

[Vit_Brykner]

Good evening Theodora,

This was indeed the issue at hand! I did not think a reboot would make the system automatically use the id key. Thank you for the prompt response, have a great rest of the week ahead!

[Theodora Boudale]

Thank you for the update @Vit_Brykner!

You are very welcome and I'm glad to have helped.

Have a great weekend and please feel free to reach out if you ever need anything else!

Kind regards,
Theodora