Uploading/installing packages to conan package registry not working with deploy tokens

Summary

I followed the documentation for using a deploy token to upload conan packages to a project level conan package registry (https://docs.gitlab.com/13.11/ee/user/packages/conan_repository/index.html#add-your-credentials-to-the-gitlab-remote).

However, I always get a permission denied error. The same works fine if I use a personal access token of my gitlab username.

We use the gitlab enterprise edition and just updated to 13.11.5.

I found this issue which might be somewhat related to that: #5813 (closed)

Steps to reproduce

  1. Add a deploy token with username (ci_conan) to the project repository with read_repository, read_package_registry, write_package_registry permissions
  2. Add the user to the remote conan user ci_conan -r gitlab -p XXXXXXXXXXXX
  3. Upload a package conan upload myTest/1.0@Test/testing -r gitlab --all
  4. Try to install a package (uploaded with a personal access token): conan install myTest/1.0@Test/testing -r gitlab 
CONAN_LOGGING_LEVEL=10 conan upload myTest/1.0@Test/testing -r gitlab
DEBUG :conan_api.py   [176]: INIT: Using config '/tmp/conan/.conan/conan.conf' [2021-06-05 12:36:46,816]
DEBUG :tracer.py      [157]: CONAN_API: upload(pattern=myTest/1.0@Test/testing,package=None,query=None,remote_name=gitlab,all_packages=False,policy=None,confirm=False,retry=None,retry_wait=None,integrity_check=False,parallel_upload=False) [2021-06-05 12:36:46,818]
Uploading to remote 'gitlab':
Uploading myTest/1.0@Test/testing to remote 'gitlab'
DEBUG :rest_client_common.py[160]: REST: ping: https://gitlab.dlr.de/api/v4/projects/123456/packages/conan/v1/ping [2021-06-05 12:36:46,823]
DEBUG :rest_client.py [58]: REST: Cached capabilities for the remote: [] [2021-06-05 12:36:46,897]
DEBUG :rest_client_common.py[188]: REST: get: https://gitlab.dlr.de/api/v4/projects/123456/packages/conan/v1/conans/myTest/1.0/Test/testing/digest [2021-06-05 12:36:46,898]
DEBUG :rest_client_common.py[30]: REST ERROR: <class 'conans.errors.ForbiddenException'> [2021-06-05 12:36:46,946]
ERROR: myTest/1.0@Test/testing: Upload recipe to 'gitlab' failed: Permission denied for user: 'ci_conan'. [Remote: gitlab]

ERROR: Errors uploading some packages

Example Project

I just created a standard conan recipe using

conan new myTest/1.0@Test/testing

What is the current bug behavior?

According to the documentation, the deploy tokens should allow uploading or installing conan packages to the package registry if the read/write permissions are set, but a permission denied error is returned.

What is the expected correct behavior?

Successful upload of packages when deploy user and deploy token are set as conan user and password.

Relevant logs and/or screenshots

CONAN_LOGGING_LEVEL=10 conan upload myTest/1.0@Test/testing -r gitlab
DEBUG :conan_api.py   [176]: INIT: Using config '/tmp/conan/.conan/conan.conf' [2021-06-05 12:36:46,816]
DEBUG :tracer.py      [157]: CONAN_API: upload(pattern=myTest/1.0@Test/testing,package=None,query=None,remote_name=gitlab,all_packages=False,policy=None,confirm=False,retry=None,retry_wait=None,integrity_check=False,parallel_upload=False) [2021-06-05 12:36:46,818]
Uploading to remote 'gitlab':
Uploading myTest/1.0@Test/testing to remote 'gitlab'
DEBUG :rest_client_common.py[160]: REST: ping: https://gitlab.dlr.de/api/v4/projects/123456/packages/conan/v1/ping [2021-06-05 12:36:46,823]
DEBUG :rest_client.py [58]: REST: Cached capabilities for the remote: [] [2021-06-05 12:36:46,897]
DEBUG :rest_client_common.py[188]: REST: get: https://gitlab.dlr.de/api/v4/projects/123456/packages/conan/v1/conans/myTest/1.0/Test/testing/digest [2021-06-05 12:36:46,898]
DEBUG :rest_client_common.py[30]: REST ERROR: <class 'conans.errors.ForbiddenException'> [2021-06-05 12:36:46,946]
ERROR: myTest/1.0@Test/testing: Upload recipe to 'gitlab' failed: Permission denied for user: 'ci_conan'. [Remote: gitlab]

ERROR: Errors uploading some packages