How to Identify Bitbucket Cloud Repositories Using App Passwords in Bamboo and Migrate to API Tokens
Platform Notice: Data Center Only - This article only applies to Atlassian apps on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
Bitbucket Cloud is deprecating App Passwords in favor of API Tokens. After 28 Jul 2026 all existing App Passwords stop working, Bamboo's integration with Bitbucket Cloud repositories that still rely on them for authentication will break.
This article provides database queries that Bamboo administrators can use to identify all Bitbucket Cloud repositories in their instance that are currently authenticated using App Passwords. Once identified, administrators can manually update those repositories to use API Tokens instead, ensuring continued connectivity with Bitbucket Cloud after the deprecation deadline.
Environment
The queries has been validated in Bamboo 9.6 but may be applicable to other versions.
Solution
This solution covers all scenarios where App Passwords may be used in Bamboo, using database queries to identify them. The queries below target Bamboo repositories at every level — Global Linked Repositories, Project Repositories, and Plan Repositories.
Use the following criteria to determine the level at which a repository is configured:
If IS_GLOBAL is set to TRUE, the repository is configured at the Global Level.
If IS_GLOBAL is FALSE and a PROJECT_KEY is present, the repository is configured at the Project Level.
If IS_GLOBAL is FALSE and a FULL_KEY is present, the repository is configured at the Plan Level.
For generating the API Tokens, please refer to the official Bitbucket Cloud documentation Create an API token | Bitbucket Cloud | Atlassian Support. For the list of recommended token permissions, please refer to Bitbucket Cloud | Bamboo Data Center 12.1. After generating your API tokens, use them as below
Username: Use the email address linked to your API token.
Password: Enter the newly created or existing API token with scopes.
Scenario 1: Bitbucket cloud type repositories using username and password authentication
The following queries identify Bitbucket cloud type repositories configured with username and password as their authentication method.
Once the affected repositories have been identified, use the repository name and its configuration level (Global, Project, or Plan) to update the username and password from App Passwords to API Tokens.
PostgreSQL
SELECT v.name,
v.is_global,
REPLACE(v.plugin_key,
'com.atlassian.bamboo.plugins.','') AS repo_type,
v.marked_for_deletion,
build.full_key,
build.title AS PLAN_TITLE,
PROJECT.PROJECT_KEY,
PROJECT.TITLE AS PROJECT_TITLE
FROM vcs_location AS v
LEFT JOIN plan_vcs_location
ON v.vcs_location_id=plan_vcs_location.vcs_location_id
LEFT JOIN build
ON (build.build_id=plan_vcs_location.plan_id
AND build.marked_for_deletion = false)
LEFT JOIN PROJECT
ON V.PROJECT_ID=PROJECT.PROJECT_ID
WHERE CAST((XPATH('//serverConfiguration/entry/string[text()="repository.bitbucket.username"]/../string[2]/text()', CAST(v.XML_DEFINITION_DATA AS XML)))[1] AS TEXT) not like '%@%'
AND v.PLUGIN_KEY='com.atlassian.bamboo.plugins.atlassian-bamboo-plugin-bitbucket:bbCloud';MySQL
SELECT v.NAME,
v.IS_GLOBAL,
REPLACE(v.PLUGIN_KEY,
'com.atlassian.bamboo.plugins.','') AS repo_type,
v.marked_for_deletion,
b.FULL_KEY,
b.TITLE AS PLAN_TITLE,
PROJECT.PROJECT_KEY,
PROJECT.TITLE AS PROJECT_TITLE
FROM bamboo.VCS_LOCATION AS v
LEFT JOIN bamboo.PLAN_VCS_LOCATION pvl
ON v.vcs_location_id=pvl.vcs_location_id
LEFT JOIN bamboo.BUILD b
ON (b.build_id=pvl.plan_id
AND b.marked_for_deletion = false)
LEFT JOIN bamboo.PROJECT
ON v.PROJECT_ID=PROJECT.PROJECT_ID
WHERE EXTRACTVALUE(v.XML_DEFINITION_DATA,'//serverConfiguration/entry/string[text()="repository.bitbucket.username"]/../string[2]/text()') not like '%@%'
AND v.PLUGIN_KEY='com.atlassian.bamboo.plugins.atlassian-bamboo-plugin-bitbucket:bbCloud';Scenario 2: Bitbucket cloud type repositories using shared credentials authentication
The following queries identify Bitbucket cloud type repositories configured with shared credentials as their authentication method.
Once the affected repositories have been identified, use the shared_credential_name to update the username and password from App Passwords to API Tokens by following the steps below:
Navigate to Overview –> Shared Credentials
Click Edit at the end of the required shared credential and update the username and password from App Passwords to API Tokens
Postgres
SELECT v.name,
cred.name AS shared_credential_name,
v.is_global,
REPLACE(v.plugin_key, 'com.atlassian.bamboo.plugins.', '') AS repo_type,
v.marked_for_deletion,
build.full_key,
build.title AS PLAN_TITLE,
PROJECT.PROJECT_KEY,
PROJECT.TITLE AS PROJECT_TITLE
FROM vcs_location AS v
LEFT JOIN plan_vcs_location
ON v.vcs_location_id = plan_vcs_location.vcs_location_id
LEFT JOIN build
ON (build.build_id = plan_vcs_location.plan_id
AND build.marked_for_deletion = false)
LEFT JOIN PROJECT
ON V.PROJECT_ID = PROJECT.PROJECT_ID
LEFT JOIN credentials AS cred
ON cred.credentials_id = CAST((XPATH('//serverConfiguration/entry/string[text()="repository.bitbucket.passwordSharedCredentials.id"]/../string[2]/text()',CAST(v.XML_DEFINITION_DATA AS XML)))[1] AS TEXT)::BIGINT
WHERE CAST((XPATH('//serverConfiguration/entry/string[text()="repository.bitbucket.passwordSharedCredentials.id"]/../string[2]/text()',CAST(v.XML_DEFINITION_DATA AS XML)))[1] AS TEXT) IS NOT NULL
AND v.PLUGIN_KEY = 'com.atlassian.bamboo.plugins.atlassian-bamboo-plugin-bitbucket:bbCloud'
AND CAST((XPATH('//configuration/username/text()',CAST(cred.xml AS XML)))[1] AS TEXT) NOT LIKE '%@%';MySQL
SELECT v.name,
cred.name AS shared_credential_name,
v.is_global,
REPLACE(v.plugin_key, 'com.atlassian.bamboo.plugins.', '') AS repo_type,
v.marked_for_deletion,
build.full_key,
build.title AS PLAN_TITLE,
PROJECT.PROJECT_KEY,
PROJECT.TITLE AS PROJECT_TITLE
FROM vcs_location AS v
LEFT JOIN plan_vcs_location
ON v.vcs_location_id = plan_vcs_location.vcs_location_id
LEFT JOIN build
ON (build.build_id = plan_vcs_location.plan_id
AND build.marked_for_deletion = false)
LEFT JOIN PROJECT
ON V.PROJECT_ID = PROJECT.PROJECT_ID
LEFT JOIN credentials AS cred
ON cred.credentials_id = CAST(
ExtractValue(v.XML_DEFINITION_DATA, '//serverConfiguration/entry/string[text()="repository.bitbucket.passwordSharedCredentials.id"]/../string[2]/text()')
AS UNSIGNED
)
WHERE ExtractValue(v.XML_DEFINITION_DATA, '//serverConfiguration/entry/string[text()="repository.bitbucket.passwordSharedCredentials.id"]/../string[2]/text()') != ''
AND v.PLUGIN_KEY = 'com.atlassian.bamboo.plugins.atlassian-bamboo-plugin-bitbucket:bbCloud'
AND ExtractValue(cred.xml, '//configuration/username') NOT LIKE '%@%';Scenario 3: Git type repositories using username and password authentication
The following queries identify Git type repositories configured with username and password authentication.
Once the affected repositories have been identified, use the repository name and its configuration level (Global, Project, or Plan) to update the username and password from App Passwords to API Tokens.
Postgres
SELECT v.name,
v.is_global,
REPLACE(v.plugin_key, 'com.atlassian.bamboo.plugins.', '') AS repo_type,
v.marked_for_deletion,
build.full_key,
build.title AS PLAN_TITLE,
PROJECT.PROJECT_KEY,
PROJECT.TITLE AS PROJECT_TITLE
FROM vcs_location AS v
LEFT JOIN plan_vcs_location
ON v.vcs_location_id = plan_vcs_location.vcs_location_id
LEFT JOIN build
ON (build.build_id = plan_vcs_location.plan_id
AND build.marked_for_deletion = false)
LEFT JOIN PROJECT
ON V.PROJECT_ID = PROJECT.PROJECT_ID
WHERE CAST((XPATH('//serverConfiguration/entry/string[text()="repository.git.username"]/../string[2]/text()', CAST(v.XML_DEFINITION_DATA AS XML)))[1] AS TEXT) NOT LIKE '%@%'
AND CAST((XPATH('//serverConfiguration/entry/string[text()="repository.git.repositoryUrl"]/../string[2]/text()', CAST(v.XML_DEFINITION_DATA AS XML)))[1] AS TEXT) LIKE '%bitbucket.org%'
AND v.PLUGIN_KEY = 'com.atlassian.bamboo.plugins.atlassian-bamboo-plugin-git:gitv2';MySQL
SELECT v.name,
v.is_global,
REPLACE(v.plugin_key, 'com.atlassian.bamboo.plugins.', '') AS repo_type,
v.marked_for_deletion,
build.full_key,
build.title AS PLAN_TITLE,
PROJECT.PROJECT_KEY,
PROJECT.TITLE AS PROJECT_TITLE
FROM vcs_location AS v
LEFT JOIN plan_vcs_location
ON v.vcs_location_id = plan_vcs_location.vcs_location_id
LEFT JOIN build
ON (build.build_id = plan_vcs_location.plan_id
AND build.marked_for_deletion = false)
LEFT JOIN PROJECT
ON V.PROJECT_ID = PROJECT.PROJECT_ID
WHERE ExtractValue(v.XML_DEFINITION_DATA, '//serverConfiguration/entry/string[text()="repository.git.username"]/../string[2]') NOT LIKE '%@%'
AND ExtractValue(v.XML_DEFINITION_DATA, '//serverConfiguration/entry/string[text()="repository.git.username"]/../string[2]') != ''
AND ExtractValue(v.XML_DEFINITION_DATA, '//serverConfiguration/entry/string[text()="repository.git.repositoryUrl"]/../string[2]') LIKE '%bitbucket.org%'
AND v.PLUGIN_KEY = 'com.atlassian.bamboo.plugins.atlassian-bamboo-plugin-git:gitv2';Scenario 4: Bitbucket cloud type repositories using shared credentials authentication
The following queries identify Git type repositories configured with shared credentials as their authentication method.
Once the affected repositories have been identified, use the shared_credential_name to update the username and password from App Passwords to API Tokens by following the steps below:
Navigate to Overview –> Shared Credentials
Click Edit at the end of the required shared credential and update the username and password from App Passwords to API Tokens
Postgres
SELECT v.name,
v.is_global,
REPLACE(v.plugin_key, 'com.atlassian.bamboo.plugins.', '') AS repo_type,
v.marked_for_deletion,
build.full_key,
build.title AS PLAN_TITLE,
PROJECT.PROJECT_KEY,
PROJECT.TITLE AS PROJECT_TITLE,
cred.name AS shared_credential_name
FROM vcs_location AS v
LEFT JOIN plan_vcs_location
ON v.vcs_location_id = plan_vcs_location.vcs_location_id
LEFT JOIN build
ON (build.build_id = plan_vcs_location.plan_id
AND build.marked_for_deletion = false)
LEFT JOIN PROJECT
ON V.PROJECT_ID = PROJECT.PROJECT_ID
LEFT JOIN credentials AS cred
ON cred.credentials_id = CAST((XPATH('//serverConfiguration/entry/string[text()="repository.git.passwordSharedCredentials"]/../string[2]/text()', CAST(v.XML_DEFINITION_DATA AS XML)))[1] AS TEXT)::BIGINT
WHERE CAST((XPATH('//serverConfiguration/entry/string[text()="repository.git.passwordSharedCredentials"]/../string[2]/text()', CAST(v.XML_DEFINITION_DATA AS XML)))[1] AS TEXT) IS NOT NULL
AND v.PLUGIN_KEY = 'com.atlassian.bamboo.plugins.atlassian-bamboo-plugin-git:gitv2'
AND CAST((XPATH('//serverConfiguration/entry/string[text()="repository.git.repositoryUrl"]/../string[2]/text()', CAST(v.XML_DEFINITION_DATA AS XML)))[1] AS TEXT) LIKE '%bitbucket.org%'
AND CAST((XPATH('//configuration/username/text()', CAST(cred.xml AS XML)))[1] AS TEXT) NOT LIKE '%@%';MySQL
SELECT v.name,
v.is_global,
REPLACE(v.plugin_key, 'com.atlassian.bamboo.plugins.', '') AS repo_type,
v.marked_for_deletion,
build.full_key,
build.title AS PLAN_TITLE,
PROJECT.PROJECT_KEY,
PROJECT.TITLE AS PROJECT_TITLE,
cred.name AS shared_credential_name
FROM vcs_location AS v
LEFT JOIN plan_vcs_location
ON v.vcs_location_id = plan_vcs_location.vcs_location_id
LEFT JOIN build
ON (build.build_id = plan_vcs_location.plan_id
AND build.marked_for_deletion = false)
LEFT JOIN PROJECT
ON V.PROJECT_ID = PROJECT.PROJECT_ID
LEFT JOIN credentials AS cred
ON cred.credentials_id = CAST(
ExtractValue(v.XML_DEFINITION_DATA, '//serverConfiguration/entry/string[text()="repository.git.passwordSharedCredentials"]/../string[2]')
AS UNSIGNED
)
WHERE ExtractValue(v.XML_DEFINITION_DATA, '//serverConfiguration/entry/string[text()="repository.git.passwordSharedCredentials"]/../string[2]') != ''
AND v.PLUGIN_KEY = 'com.atlassian.bamboo.plugins.atlassian-bamboo-plugin-git:gitv2'
AND ExtractValue(v.XML_DEFINITION_DATA, '//serverConfiguration/entry/string[text()="repository.git.repositoryUrl"]/../string[2]') LIKE '%bitbucket.org%'
AND ExtractValue(cred.xml, '//configuration/username') NOT LIKE '%@%';Was this helpful?