Looks like they fixed a similar issue in 8.20.17, but I'm not sure it's directly tied to our issue here: 
JSWSERVER-21370 Duplicate values in AO_E8B6CC_COMMIT leads to DVCS MessageConsumer failure.
 
That issue lists 8.20.17 and 9.5.0 as the fixes, nothing in 9.4.x.
 
Guess we'll wait and see what is in 9.4.3 and 8.20.18.

All,

I have a response (whether this means Jira 9.4.2 or a yet-unreleased 9.4.3, likewise with 8.20.x, I don't know yet):

We apologize for the delay on this request. We have just received confirmation from the Jira Dev team that the bug fix was backported to 8.20.x and 9.4.x versions of Jira as well. 

The bug report Fix Version will be updated to match this information.

We hope to have addressed your questions. Please let us know in case there's any other information we could provide on this matter.

Regards,
Atlassian Support Engineer

I have a support ticket to Atlassian to confirm if this is being backported to the LTS lines (Jira 9.4.x and 8.20.x) right now it just shows, at least here, fixed in 9.5.x

Hi, I see that this issue was closed. Does it mean the bug is fixed?

Until this is resolved, regularily reset / reissue manually the OAuth token:

• in Adminstration / Applications / DVCS Accounts
• click the Gitlab account
• in Accounting Tools choose Reset OAuth Settings (BTW this name is misleading and scary, thus usually avoided. It makes sense to rename it)
• choose Regenerate Access Token

Unfortunately, this is a manual procedure.

Environment:

• Jira server 8.20.11
• GitLab self hosted 15.3.4 ee

Procedure to reproduce:

• set up the JIRA-GitLab self hosted integration as of https://confluence.atlassian.com/adminjiraserver0820/linking-gitlab-accounts-1095776607.html
• the repositories (3400+ in our case) are listed and the synchronization starts, the development pannel is working fine
• in JIRA / Administration / System / Logging and profiling add the loggers:
  • com.atlassian.oauth2.client with TRACE level
  • com.atlassian.jira.plugin.dvcs with TRACE level
• after 4-6-12 hours the following messages appear in the log:

  2022-10-19 15:05:57,532+0200 http-nio-8080-exec-370532 DEBUG anonymous 905x51145501x44 - ... /rest/bitbucket/1.0/webhook/gitlab [c.a.o.c.lib.token.DefaultTokenService] Trying to get tokens for an integration with a client id - e0273abb7fdd387cd5f469232754fea80b31c938e699cc7a4a7a6f80c0c12f8c
  2022-10-19 15:05:57,839+0200 http-nio-8080-exec-370532 TRACE anonymous 905x51145501x44 - ... /rest/bitbucket/1.0/webhook/gitlab [c.a.o.c.lib.token.DefaultTokenService] Got OAuth Provider response: [400], [{"error":"invalid_grant","error_description":"The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client."}
  
  ...	
  ... /rest/bitbucket/1.0/webhook/gitlab [c.a.o.c.lib.token.DefaultTokenService] Got OAuth Provider response: [400], [{"error":"invalid_grant","error_description":"The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to 
  another client."}
      ]
  /rest/bitbucket/1.0/webhook/gitlab [c.a.j.p.d.gitlab.impl.OAuthTokenProviderImpl] Failed to get access token
  com.atlassian.oauth2.client.api.lib.token.TokenServiceException: The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued
   to another client.
          at com.atlassian.oauth2.client.lib.token.DefaultTokenService.getToken(DefaultTokenService.java:146)
          at com.atlassian.oauth2.client.lib.token.DefaultTokenService.forceRefresh(DefaultTokenService.java:71)
  ...
          at com.sun.proxy.$Proxy3722.forceRefresh(Unknown Source)
          at com.atlassian.jira.plugins.dvcs.auth.OAuth2TokenHandler.refreshToken(OAuth2TokenHandler.java:52)
          at com.atlassian.jira.plugins.dvcs.auth.OAuth2Service.getAccessToken(OAuth2Service.java:97)
          at com.atlassian.jira.plugins.dvcs.gitlab.impl.OAuthTokenProviderImpl.getAccessToken(OAuthTokenProviderImpl.java:40)
          at com.atlassian.jira.plugins.dvcs.gitlab.impl.GitLabRestClientImpl.createOAuthFilter(GitLabRestClientImpl.java:453)
          at com.atlassian.jira.plugins.dvcs.gitlab.impl.GitLabRestClientImpl.getUser(GitLabRestClientImpl.java:76)
          at com.atlassian.jira.plugins.dvcs.spi.gitlab.GitLabCommunicator.getUser(GitLabCommunicator.java:260)
          at com.atlassian.jira.plugins.dvcs.service.remote.CachingCommunicator$UserLoader.load(CachingCommunicator.java:275)
          at com.atlassian.jira.plugins.dvcs.service.remote.CachingCommunicator$UserLoader.load(CachingCommunicator.java:271)
          at com.atlassian.cache.memory.MemoryCacheManager$2.load(MemoryCacheManager.java:192)
          at com.atlassian.cache.memory.DelegatingCache.lambda$get$0(DelegatingCache.java:163)
          at com.atlassian.cache.memory.DelegatingCache$$Lambda$252/424410698.get(Unknown Source)
          at com.atlassian.cache.memory.DelegatingCache.lambda$get$1(DelegatingCache.java:191)
  ...
  ... /rest/bitbucket/1.0/repository/21039/softsync [c.a.j.p.d.gitlab.impl.OAuthTokenProviderImpl] Failed to get access token
  com.atlassian.oauth2.client.api.lib.token.TokenServiceException: The requested scope is invalid, unknown, or malformed.
  	at com.atlassian.oauth2.client.lib.token.DefaultTokenService.getToken(DefaultTokenService.java:146)
  	at com.atlassian.oauth2.client.lib.token.DefaultTokenService.forceRefresh(DefaultTokenService.java:71)
  ...
  	at com.sun.proxy.$Proxy3722.forceRefresh(Unknown Source)
  	at com.atlassian.jira.plugins.dvcs.auth.OAuth2TokenHandler.refreshToken(OAuth2TokenHandler.java:52)
  	at com.atlassian.jira.plugins.dvcs.auth.OAuth2Service.getAccessToken(OAuth2Service.java:97)
  	at com.atlassian.jira.plugins.dvcs.gitlab.impl.OAuthTokenProviderImpl.getAccessToken(OAuthTokenProviderImpl.java:40)
  	at com.atlassian.jira.plugins.dvcs.gitlab.impl.GitLabRestClientImpl.createOAuthFilter(GitLabRestClientImpl.java:453)
  	at com.atlassian.jira.plugins.dvcs.gitlab.impl.GitLabRestClientImpl.getMergeRequests(GitLabRestClientImpl.java:235)
  

  That these messages are not logged by default.

The latter exception also causes

... /rest/bitbucket/1.0/webhook/gitlab [c.a.j.p.dvcs.service.RepositoryServiceImpl] Could not load user [<username>, <actual name>]
com.atlassian.jira.plugins.dvcs.exception.SourceControlException: java.lang.NullPointerException
        at com.atlassian.jira.plugins.dvcs.service.remote.CachingCommunicator.unrollException(CachingCommunicator.java:66)
        at com.atlassian.jira.plugins.dvcs.service.remote.CachingCommunicator.getUser(CachingCommunicator.java:60)
        at com.atlassian.jira.plugins.dvcs.service.RepositoryServiceImpl.getUser(RepositoryServiceImpl.java:589)
        at com.atlassian.jira.plugins.dvcs.service.api.DvcsRepositoryServiceImpl.getDvcsUser(DvcsRepositoryServiceImpl.java:45)
        at sun.reflect.GeneratedMethodAccessor5372.invoke(Unknown Source)
        ... 1 filtered

reported with INFO level.

Monitoring the communication with GitLab revealed that

• when there were no parallel token token refresh requests, the token refresh worked fine, refrehsed each 2 hours.
• in the second one refresh succeeded and the next refresh failed, there were 13 parallel requests from JIRA to GITLAB for refreshing the same token. 1 succeeded, 12 failed.
• since then all refresh requests fail.

JIRA Request:
POST /oauth/token
"refresh_token"=>"....", "grant_type"=>"refresh_token", "scope"=>"api", "client_secret"=>"....", "client_id"=>"...."}

Analysis:

• it seems that JIRA is trying to refresh the same token in 13 parallel threads
• this floods Gitlab with requests and (probably a race condition at GitLab side) causes the token to expire
• there is an issue with the reques Jira sends, so even if the token has expired, it cannot be refreshed, so that GitLab responds:

HTTP 400

Suggestion:

• make the com.atlassian.oauth2.client.lib.DefaultTokenService.getToken() method synchronized so that only one thread at a time could review/refresh an OAuth2 token as this service is a singleton

I tried to reproduce this issue using the latest version of Jira (v8.21.1) and latest GitLab. I've also used the GitLab self-hosted DVCS connector instead of GitHub enterprise. In this setup it works as expected, showing the pull request even if the issue ID was only mentioned in a commit message.

For more details, see my comment in the related issue on GitLab.com: https://gitlab.com/gitlab-org/gitlab/-/issues/350894#note_839095239

I have been working on an Atlassian support case to gather information about this issue.  I learned that the following Jira database tables are used by the DVCS Connector.

The most interesting thing I found so far when querying these tables in our Jira database is that the AO_E8B6CC_COMMIT table (Commits per PR) is empty.