Connecting Bitbucket: Error! Invalid OAuth credentials.

[julianhaagsma]

Hi! This seems like something super basic, but I've been stuck on it for a few hours now, and am running in circles.

I'm trying to add a DVCS account for Bitbucket Cloud into our JIRA Software Server.

I generated an OAuth consumer in bitbucket (for our Team) , and copied and pasted the Key & Secret to the "Link Bitbucket Cloud or Github"/"Add New Account" dialogue.... and get:

Error!

Invalid OAuth credentials. Check Jira log for more information.

After adding an add-on - ScriptRunner - I have managed to actually get access to the log files. It tells us the following, rather unhelpfully:

2019-12-06 18:18:59,423 http-nio-8080-exec-19 WARN Julian 1098x2513x1 1o2vkzv 172.17.0.1 /secure/admin/AddBitbucketOrganization.jspa [c.a.j.p.d.s.b.clientlibrary.request.BaseRemoteRequestor] Failed to properly execute request [GET https://api.bitbucket.org/2.0/user?oauth_nonce=ca105573-0ea5-4167-a7ff-0192bcee4512&oauth_signature=u5g%2BHLXaHIdt94S8jTJzBHcHVew%3D&oauth_consumer_key=HYmWySkhsHub2N2sz8&oauth_timestamp=1575656339&oauth_signature_method=HMAC-SHA1&oauth_version=1.0]
Headers: [User-Agent: Jira DVCS Connector/5.2.6]
Params: [parameters={}]
Response code: 401
Response headers: [Server: nginx, WWW-Authenticate: OAuth realm="Bitbucket.org HTTP", Content-Type: text/html; charset=utf-8, Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, Date: Fri, 06 Dec 2019 18:18:59 GMT, X-Served-By: app-1137, X-Static-Version: abd48467d96e, ETag: "d41d8cd98f00b204e9800998ecf8427e", X-Render-Time: 0.00551915168762, Connection: Keep-Alive, X-Version: abd48467d96e, X-Request-Count: 2891, X-Frame-Options: SAMEORIGIN, X-Cache-Info: not cacheable; response code not cacheable, Content-Length: 0]
2019-12-06 18:18:59,424 http-nio-8080-exec-19 ERROR Julian 1098x2513x1 1o2vkzv 172.17.0.1 /secure/admin/AddBitbucketOrganization.jspa [c.a.j.p.d.s.bitbucket.webwork.AddBitbucketOrganization] Exception while trying to fetch UUID from OAUTH credentials. Check if the credentials are correct.
com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.request.BitbucketRequestException$Unauthorized_401: 
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.request.BaseRemoteRequestor.checkAndCreateRemoteResponse(BaseRemoteRequestor.java:265)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.request.BaseRemoteRequestor.request(BaseRemoteRequestor.java:227)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.request.BaseRemoteRequestor.requestWithoutPayload(BaseRemoteRequestor.java:210)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.request.BaseRemoteRequestor.lambda$getWithRetry$0(BaseRemoteRequestor.java:131)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.client.BitbucketRetryer.retry(BitbucketRetryer.java:27)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.client.BitbucketRetryer.retry(BitbucketRetryer.java:20)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.request.BaseRemoteRequestor.getWithRetry(BaseRemoteRequestor.java:131)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.request.BaseRemoteRequestor.get(BaseRemoteRequestor.java:86)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.clientlibrary.restpoints.AccountRemoteRestpoint.getCurrentUser(AccountRemoteRestpoint.java:24)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.webwork.AddBitbucketOrganization.getOrganizationUuid(AddBitbucketOrganization.java:346)
at com.atlassian.jira.plugins.dvcs.spi.bitbucket.webwork.AddBitbucketOrganization.doValidation(AddBitbucketOrganization.java:230)
... 2 filtered
at com.atlassian.jira.action.JiraActionSupport.execute(JiraActionSupport.java:63)
... 7 filtered
at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
... 48 filtered
at com.atlassian.greenhopper.jira.filters.ClassicBoardRouter.doFilter(ClassicBoardRouter.java:62)
... 7 filtered
at com.atlassian.jira.plugin.mobile.web.filter.MobileAppRequestFilter.doFilter(MobileAppRequestFilter.java:37)
... 4 filtered
at com.atlassian.jira.plugin.mobile.login.MobileLoginSuccessFilter.doFilter(MobileLoginSuccessFilter.java:54)
... 3 filtered
at com.atlassian.diagnostics.internal.platform.monitor.http.HttpRequestMonitoringFilter.doFilter(HttpRequestMonitoringFilter.java:55)
... 8 filtered
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)
... 66 filtered
at com.atlassian.jira.security.JiraSecurityFilter.lambda$doFilter$0(JiraSecurityFilter.java:66)
... 1 filtered
at com.atlassian.jira.security.JiraSecurityFilter.doFilter(JiraSecurityFilter.java:64)
... 39 filtered
at com.atlassian.jira.servermetrics.CorrelationIdPopulatorFilter.doFilter(CorrelationIdPopulatorFilter.java:30)
... 10 filtered
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)
... 4 filtered
at com.atlassian.web.servlet.plugin.LocationCleanerFilter.doFilter(LocationCleanerFilter.java:36)
... 26 filtered
at com.atlassian.jira.servermetrics.MetricsCollectorFilter.doFilter(MetricsCollectorFilter.java:25)
... 25 filtered
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)

Is there something I'm doing wrong? 

One note is that we do not currently have this running on a server that is accessible externally - because of IT reasons - but I figured that requests originating from our server should still be fine? (Also, it's running on port 8088 - again, because IT reasons...)

[julianhaagsma · Accepted solution]

Okay, after button mashing a bit harder, it seemed that checking "this is a private consumer" made it work. This is not in the documentation.

Hopefully this fixes somebody else's issue!

[Vinnie Chhabra]

Thanks so much fo rposting this!  I was going in circles also and creating the OAUTH key pair 3 times without success until I read this :) 

[Gunnlaugur Jonsson]

Thanks Julian - I had the exact same problem and your solution worked perfectly!

[meschg]

Same issue - thats it :)

[Rich Scire]

I'm not generating the OAuth information so I don;t have acess to Bitbucket. I don't see such a button in Jira, was the button mashing on the Bitbucket.org side?

[meschg]

Yes it is a checkbox when generating the OAuth consumer in Bitbucket when generating

[Alexandre Léveillé]

It might help someone in the future..... we were able to make it work by checking the "This is a private consumer" box when creating the OAuth access token on Bitbucket (this page: https://support.atlassian.com/bitbucket-cloud/docs/connect-bitbucket-cloud-to-jira-software-server/ doesn't mention the box)