Jira DVCS synchronization fails with the "Invalid credentials" error
Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
A DVCS GitHub Enterprise repository synchronization might fail with the error "Invalid credentials, please reset OAuth settings" for a number of reasons.
Diagnosis
In the atlassian-jira.log we can observe the error Bad credentials (401), as in the example:
1
2
3
4
5
6
7
8
9
10
11
12
13
2020-09-09 18:54:55,761 http-nio-x.x.x.x-8081-exec-80 url:/rest/bitbucket...epository/12/sync INFO anonymous 1134x10999251x11 kjlbkc x.x.x.x,x.x.x.x /rest/bitbucket/1.0/repository/12/sync [c.a.j.p.d.r.external.v1.RepositoryResource] Postcommit hook started synchronization for repository [12].
2020-09-09 18:54:55,848 http-nio-x.x.x.x-8081-exec-80 url:/rest/bitbucket...epository/12/sync INFO anonymous 1134x10999251x11 kjlbkc x.x.x.x,x.x.x.x /rest/bitbucket/1.0/repository/12/sync [c.a.j.p.d.spi.github.GithubCommunicator] Can not obtain branches list from repository [ MyREPO ] org.eclipse.egit.github.core.client.RequestException: Bad credentials (401)
at org.eclipse.egit.github.core.client.GitHubClient.createException(GitHubClient.java:552)
at org.eclipse.egit.github.core.client.GitHubClient.get(GitHubClient.java:740)
at org.eclipse.egit.github.core.client.PageIterator.next(PageIterator.java:173)
at org.eclipse.egit.github.core.service.GitHubService.getAll(GitHubService.java:151)
at org.eclipse.egit.github.core.service.GitHubService.getAll(GitHubService.java:135)
at org.eclipse.egit.github.core.service.RepositoryService.getBranches(RepositoryService.java:785)
at com.atlassian.jira.plugins.dvcs.spi.github.GithubCommunicator.getBranches(GithubCommunicator.java:515)
at com.atlassian.jira.plugins.dvcs.spi.github.GithubCommunicator.startSynchronisation(GithubCommunicator.java:604)
at com.atlassian.jira.plugins.dvcs.service.remote.CachingCommunicator.startSynchronisation(CachingCommunicator.java:98)
at com.atlassian.jira.plugins.dvcs.sync.impl.DefaultSynchronizer.doSync(DefaultSynchronizer.java:173)
at com.atlassian.jira.plugins.dvcs.service.RepositorySyncServiceImpl.doSync(RepositorySyncServiceImpl.java:440)Cause
Root cause 1: Lack of permissions
If the account used doesn't have access to a repository, we'll face an invalid credentials error. Grant access to the GitHub account should fix the problem
Root cause 2: OAuth token revoked
You will face this error if, for any reason, the token is revoked. Please reset the OAuth Settings in order to regenerate access token:
Click on the ellipsis (...) icon and select the Reset OAuth Settings option
Click on Edit
Enter the Key and Secret and click on Regenerate Access Token
Root cause 3: More than 10 organizations
If you have more than 10 organizations for the same account in GitHub Enterprise, you might experience the following symptoms:
"Invalid credentials" errors
Reset the OAuth settings
The sync runs successfully but after some hours, the error happens again
There is a limit of ten tokens that are issued per user/application/scope combination, and a rate limit of ten tokens created per hour. If an application creates more than ten tokens for the same user and the same scopes, the oldest tokens with the same user/application/scope combination are revoked.
In this case, you must set up the OAuth App via the Organization and not via the Service Account. To do this, the Service Account needs to have Owner access to the Organization being linked.
References:
Root cause 4: Usage of GitHub app to establish connection instead of OAuth App
As per the current application design, we expect that connection will be established with the help of the OAuthapp rather than the GitHubapp (Differences between GitHub Apps and OAuth apps). Although using the GitHub app gives a lot more granularity in the permission levels on GitHub compared to the OAuth app, making it a better candidate for large instances. However, at the current moment, the Jira DVCS plugin doesn't fully support the usage of the GitHub app for the integration.
Technically, you can establish a connection between Jira and GitHub using such a configuration. However, we would not be able to automatically refresh OAuth tokens, and intergrading will start to fail after 8 hours (this explains why it might initially work in your case but start to fail after some time). Please refer to the below feature request for extra details:
We have a feature request to add full support of GitHubapp into a product:
In the meantime, please make sure that the connection is established using the OAuth app, following the steps in the "Linking GitHub accounts" user guide.
Was this helpful?