We recently upgraded to v10.2.8 and were excited to use local service accounts, but we hit this “limitation.”

We hoped to use local service accounts instead of Active Directory service accounts for git clone, fetch, and push activities. PATs as well as HTTP access tokens are already in use, but each has its limitations and concerns (see below)

Some of our development teams use application links to authenticate, which works for more technical teams and integrations, but it's overkill for simpler use cases.

Some users don’t need to clone, and for them, service accounts in their present state are fine, but adding git operation support would be great.

Why this is important:

• SSH and HTTP access keys are by repo or project. We cannot share an HTTP token across multiple projects or repos. For solutions that span multiple projects, we prefer not to manage different credentials.
• We also prefer that only application admins can define which projects/repos a service account can access. With HTTP tokens, repo admins can generate them.
• From our perspective, service accounts are more secure because the customer manages a client ID and secret; they use those to get a temporary token for operations. As admins, we can always rotate that client ID/secret, and if a temp token gets exposed, it is ephemeral. If an HTTP token is exposed, it depends on whether it has an expiration.