Uploaded image for project: 'Bitbucket Data Center'
  1. Bitbucket Data Center
  2. BSERV-10482

Create admin personal tokens for admin endpoints in Bitbucket Server REST API

XMLWordPrintable

    • 337
    • We collect Bitbucket feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      Problem Definition

      In Bitbucket Server 5.5 personal access tokens have been introduced. They can be used to replace passwords over https, or to authenticate using the Bitbucket Server REST API over Basic Auth. However the tokens cannot be used for administrative access REST endpoints like /rest/access-tokens/latest/users/admin or
      /rest/api/1.0/admin/permissions/groups

      The error message: Tokens may not have the following permission: ADMIN

      Suggested Solution

      Please provide the access tokens with the global ADMIN permissions.

      Why this is important

      Using tokens for the system management automation is more comfortable and secure rather than login-password authentication.

            [BSERV-10482] Create admin personal tokens for admin endpoints in Bitbucket Server REST API

            Nitin Sharma added a comment -

            https://getsupport.atlassian.com/browse/PSSRV-153790

            Nitin Sharma added a comment - https://getsupport.atlassian.com/browse/PSSRV-153790

            Anton Shaleev added a comment -

            It is not a 100% solution but as a workaround, you can use OAuth2 tokens for Bitbucket 7.21 and newer.
            https://confluence.atlassian.com/bitbucketserverkb/how-to-use-oauth2-tokens-for-administrative-endpoints-of-bitbucket-data-center-1489469945.html

            Anton Shaleev added a comment - It is not a 100% solution but as a workaround, you can use OAuth2 tokens for Bitbucket 7.21 and newer. https://confluence.atlassian.com/bitbucketserverkb/how-to-use-oauth2-tokens-for-administrative-endpoints-of-bitbucket-data-center-1489469945.html

            Travis Sharp added a comment -

            Using tokens instead of basic auth has become the standard for our development. Our security team wants to enforce this as a standard across our footprint. I need this in place to remain compliance with our audit department.

            Travis Sharp added a comment - Using tokens instead of basic auth has become the standard for our development. Our security team wants to enforce this as a standard across our footprint. I need this in place to remain compliance with our audit department.

            Jason Kemp added a comment -

            Using tokens instead of username/passwords is a way to improve security. So, for the endpoints that should have the most security associated with them, we can't use tokens? Who decided that?

            System Admin should just be another level selectable when creating the token.

            Jason Kemp added a comment - Using tokens instead of username/passwords is a way to improve security. So, for the endpoints that should have the most security associated with them, we can't use tokens? Who decided that? System Admin should just be another level selectable when creating the token.

            Antoine Lemaitre added a comment -

            Hi,

            For security purpose, it should be available, because we must use passwords instead of tokens to authenticate in our admin scripts.

            Antoine Lemaitre added a comment - Hi, For security purpose, it should be available, because we must use passwords instead of tokens to authenticate in our admin scripts.

            Imran Khan added a comment -

            Hi ashaleev

            Thanks for the suggestion. We decided not include this permission in the personal tokens due to security reasons. Allowing more permissions for tokens is not on our short term roadmap but, can reconsider based on feedback and comments form all the users. I'm opening this issue.

            Imran Khan added a comment - Hi ashaleev Thanks for the suggestion. We decided not include this permission in the personal tokens due to security reasons. Allowing more permissions for tokens is not on our short term roadmap but, can reconsider based on feedback and comments form all the users. I'm opening this issue.

              Unassigned Unassigned
              ashaleev Anton Shaleev
              Votes:
              32 Vote for this issue
              Watchers:
              42 Start watching this issue

                Created:
                Updated: