403 Forbidden error when creating a Gitlab repository in Bamboo
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
When adding a Gitlab repository to Bamboo, the connection fails with the following error:tra
fatal: unable to access 'https://user@git.lab.instance/FTT/card-catering-report.git/': The requested URL returned error: 403Environment
Observed on Bamboo 8.2.5 connected with a self-managed Gitlab instance.
Diagnosis
The following error can be seen in the <bamboo-home>/logs/atlassian-bamboo.log file:
2022-10-07 09:38:27,607 INFO [http-nio-8085-exec-24] [RepositoryResource] Failed to connect to repository (type: Git, location: https://user@git.lab.instance/project/repository.git/, time: 331.9 ms, errors: [remote: Forbidden
fatal: unable to access 'https://user@git.lab.instance/project/repository.git/': The requested URL returned error: 403])Builds fail and the following stack trace can be found in the same file:
2022-10-07 09:36:38,142 ERROR [7-DelayedChangeDetectionThread:pool-9-thread-2] [ChainExecutionManagerImpl] Plan 'PROJ-PLAN' could not be started. Exception: command ['C:\Program Files\Git\cmd\git.exe' -c credential.helper= -c 'credential.helper=store --file=C:/PROGRA~1/Bamboo/temp/GITCRE~1.TMP' ls-remote https://user@git.lab.instance/project/repository.git] failed with code 128. Working directory was [C:\Program Files\Bamboo\temp]., stderr:
remote: Forbidden
fatal: unable to access 'https://user@git.lab.instance/project/repository.git/': The requested URL returned error: 403
com.atlassian.bamboo.plugins.git.GitCommandException: command ['C:\Program Files\Git\cmd\git.exe' -c credential.helper= -c 'credential.helper=store --file=C:/PROGRA~1/Bamboo/temp/GITCRE~1.TMP' ls-remote https://user@git.lab.instance/project/repository.git] failed with code 128. Working directory was [C:\Program Files\Bamboo\temp]., stderr:
remote: Forbidden
fatal: unable to access 'https://user@git.lab.instance/project/repository.git/': The requested URL returned error: 403
at com.atlassian.bamboo.plugins.git.GitCommandProcessor.runCommand(GitCommandProcessor.java:773)
at com.atlassian.bamboo.plugins.git.GitCommandProcessor.getRemoteRefs(GitCommandProcessor.java:528)
at com.atlassian.bamboo.plugins.git.NativeGitOperationHelper.lambda$getRemoteRefs$1(NativeGitOperationHelper.java:621)
at com.atlassian.bamboo.util.CallableResultCache$1.load(CallableResultCache.java:39)
at com.atlassian.bamboo.util.CallableResultCache$1.load(CallableResultCache.java:35)
at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3533)
at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2282)
[...]
at com.atlassian.bamboo.utils.collections.AlwaysInvalidatingCacheDecorator.get(AlwaysInvalidatingCacheDecorator.java:65)
at com.atlassian.bamboo.utils.collections.AlwaysInvalidatingCacheDecorator.getUnchecked(AlwaysInvalidatingCacheDecorator.java:126)
at com.atlassian.bamboo.util.CallableResultCache.call(CallableResultCache.java:142)
at com.atlassian.bamboo.plugins.git.NativeGitOperationHelper.getRemoteRefs(NativeGitOperationHelper.java:629)
at com.atlassian.bamboo.plugins.git.NativeGitOperationHelper.resolveBranch(NativeGitOperationHelper.java:581)
at com.atlassian.bamboo.plugins.git.NativeGitOperationHelper.obtainLatestRevision(NativeGitOperationHelper.java:700)
at com.atlassian.bamboo.plugins.git.v2.GitChangeDetector.collectChanges(GitChangeDetector.java:155)
at com.atlassian.bamboo.plugins.git.v2.GitChangeDetector.collectChangesSinceRevision(GitChangeDetector.java:73)
at com.atlassian.bamboo.v2.trigger.DefaultChangeDetectionManager.collectionChangesWithRetry(DefaultChangeDetectionManager.java:579)
at com.atlassian.bamboo.v2.trigger.DefaultChangeDetectionManager.lambda$createBuildRepositoryChanges$2(DefaultChangeDetectionManager.java:478)
at com.atlassian.bamboo.variable.CustomVariableContextImpl.withVariableSubstitutor(CustomVariableContextImpl.java:118)
at com.atlassian.bamboo.v2.trigger.DefaultChangeDetectionManager.collectChangesSinceLastBuildInternal(DefaultChangeDetectionManager.java:439)
at com.atlassian.bamboo.v2.trigger.DefaultChangeDetectionManager.collectChangesSinceRevisions(DefaultChangeDetectionManager.java:287)
at com.atlassian.bamboo.v2.trigger.DefaultChangeDetectionManager.collectChangesSinceRevisions(DefaultChangeDetectionManager.java:220)
at com.atlassian.bamboo.v2.trigger.DefaultChangeDetectionManager.collectAllChangesSinceLastBuild(DefaultChangeDetectionManager.java:164)
at com.atlassian.bamboo.v2.trigger.DefaultChangeDetectionManager.collectAllChangesSinceLastBuild(DefaultChangeDetectionManager.java:190)
at com.atlassian.bamboo.v2.trigger.ManualBuildDetectionAction.performDelayedChangeDetection(ManualBuildDetectionAction.java:160)
at com.atlassian.bamboo.chains.ChainExecutionManagerImpl$1.getChainState(ChainExecutionManagerImpl.java:267)
at com.atlassian.bamboo.chains.ChainExecutionManagerImpl.tryStartChainState(ChainExecutionManagerImpl.java:339)
at com.atlassian.bamboo.chains.ChainExecutionManagerImpl.delayedStart(ChainExecutionManagerImpl.java:259)
[...]Cause
There are a few possible causes:
- Incorrect credentials for authentication
- Your Bamboo proxy is misconfigured
- Gitlab is configured to require 2FA authentication
- The Gitlab account does not have an SSH key set up
Solution
Incorrect credentials for authentication
Please make sure that you are using the correct username and password to authenticate against the repository. You can test the credentials outside Bamboo to be sure they are correct by running Git operations (clone i.e.) against the desired repository.
Your Bamboo proxy is misconfigured
A misconfigured proxy in front of Bamboo can cause issues with Gitlab communication. All details and steps to fix that is described in the following article:
Gitlab is configured to require 2FA authentication
If your Gitlab instance has two-factor authentication (2FA) enabled, please note that personal access tokens (PAT) are required, meaning you'll need to create a PAT for the Gitlab account and use it in Bamboo to to connect with Gitlab. More information is available in the following Gitlab documentation:
The Gitlab account does not have an SSH key set up
A GitLab account needs an SSH key in order for Git operations to be allowed, and that can impact the connection with Bamboo. If that's the case, you'll see the following banner at the top of the screen while accessing a Gitlab project:
Please make sure to add at least one SSH key to the Gitlab account so that Gitlab doesn't block connections.