Using single OAuth configuration for multiple gitlab groups in DVCS drives to token expiration in near future

XMLWordPrintable

    • 8
    • 17
    • Severity 3 - Minor
    • 3

      Issue Summary

      This is reproducible on Data Center: YES

      Predefined Environment:

      • Jira SW ** (all tiers)
      • Gitlab Cloud / SelfManaged (version > 15.0)

         

      Steps to Reproduce:

      1. Lets create 2 gitlab groups → test1, test2 and populate them with (at least) one repository
      2. Let’s create one OAuth configuration in Jira for this Gitlab instance following official KB
      3. Link both Gitlab groups (test1, test2) with Jira using single OAuth configuration just created
      4. Let's manually shorten ACCESS_TOKEN_EXPIRATION in for both of them to force token refresh (or we can wait ~2 hours to get token expired)
      5. Now let's trigger REFRESH_REPOSITORIES on DVCS UI page for test2 organisation
      6. Now let's trigger REFRESH_REPOSITORIES on DVCS UI page for test1 organisation
      7. Go to test1 DVCS account to see repositories

      Expected Results

      Both groups have working OAuth integration and work correct.

      Actual Results

      test1 group doesn't contain any repositories. They got removed because not working OAuth integration
      Also in the logs (in DEBUG level) we might see:

      Failed to refresh the token. Will return the token from the database

      Workaround

      Working workaround is to use individual OAuth configuration for each Gitlab group linked via DVCS

      Notes

      Linking multiple gitlab accounts to a single Application Links would cause some of the git lab accounts repositories went missing via DVCS. There is a warning banner mentioned in Link your GitLab account quoted:

      Don't link multiple team or user accounts under the same client configuration (outgoing application link). Instead, make sure that each GitLab team and user account you link with Jira uses a separate client configuration.

            Assignee:
            Yann
            Reporter:
            awojtasik
            Votes:
            9 Vote for this issue
            Watchers:
            12 Start watching this issue

              Created:
              Updated:
              Resolved: