401 error when cloning repository using service account

Summary

Unable to clone repository with service account.

The service account is working for APIs such as listing of a project.

Steps to reproduce

  1. Create a service account under a group using API.
  2. Grant the service account Developer role in the group.
  3. Create a personal access token for the service account with write_repository and read_repository scope.
  4. Create a project in the group with a README file.
  5. Clone the repository using personal access token.

Example Project

What is the current bug behavior?

Error when cloning repository using service account.

What is the expected correct behavior?

Users can use service account to clone a repository.

Relevant logs and/or screenshots

Token generation:

curl -XPOST https://omnibus-instance.XXX.net/api/v4/groups/181/service_accounts/56/personal_access_tokens -H "PRIVATE-TOKEN: $GITLAB_TOKEN" --data "scopes[]=write_repository" --data "scopes[]=read_repository" --data "scopes[]=api" --data "name=423304-svc-acct-token-56"

{"id":36,"name":"423304-svc-acct-token-56","revoked":false,"created_at":"2023-06-28T12:05:54.095Z","scopes":["write_repository","read_repository","api"],"user_id":56,"last_used_at":null,"active":true,"expires_at":"2024-06-27","token":"XXX"}%

Clone repository:

❯ git clone https://service_account_group_181_XXX:XXXX@omnibus-instance.XXX.net/zd/423304-service-account/new_project.git

Cloning into 'new_project'...
remote: HTTP Basic: Access denied. The provided password or token is incorrect or your account has 2FA enabled and you must use a personal access token instead of a password. See https://omnibus-instance.XXX.net/help/topics/git/troubleshooting_git#error-on-git-fetch-http-basic-access-denied
fatal: Authentication failed for 'https://omnibus-instance.XXX.net/zd/423304-service-account/new_project.git/'

Error in logs:

{"method":"GET","path":"/zd/423304-service-account/new_project.git/info/refs","format":"*/*","controller":"Repositories::GitHttpController","action":"info_refs","status":401,"time":"2023-06-28T12:22:56.696Z","params":[{"key":"service","value":"git-upload-pack"},{"key":"repository_path","value":"zd/423304-service-account/new_project.git"}],"remote_ip":"XXX","ua":"git/2.39.2","response_bytes":306,"request_urgency":"default","target_duration_s":1,"db_count":7,"db_write_count":0,"db_cached_count":1,"db_replica_count":0,"db_primary_count":7,"db_main_count":7,"db_ci_count":0,"db_main_replica_count":0,"db_ci_replica_count":0,"db_replica_cached_count":0,"db_primary_cached_count":1,"db_main_cached_count":1,"db_ci_cached_count":0,"db_main_replica_cached_count":0,"db_ci_replica_cached_count":0,"db_replica_wal_count":0,"db_primary_wal_count":0,"db_main_wal_count":0,"db_ci_wal_count":0,"db_main_replica_wal_count":0,"db_ci_replica_wal_count":0,"db_replica_wal_cached_count":0,"db_primary_wal_cached_count":0,"db_main_wal_cached_count":0,"db_ci_wal_cached_count":0,"db_main_replica_wal_cached_count":0,"db_ci_replica_wal_cached_count":0,"db_replica_duration_s":0.0,"db_primary_duration_s":0.005,"db_main_duration_s":0.005,"db_ci_duration_s":0.0,"db_main_replica_duration_s":0.0,"db_ci_replica_duration_s":0.0,"cpu_s":0.039278,"mem_objects":9634,"mem_bytes":640408,"mem_mallocs":3285,"mem_total_bytes":1025768,"pid":44141,"worker_id":"puma_0","rate_limiting_gates":[],"correlation_id":"01H40Z9VWBEQHS8E89WZYAG58T","db_duration_s":0.00453,"view_duration_s":0.00051,"duration_s":0.02694}

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info 

(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check 
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)


(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)


(we will only investigate if the tests are passing)

Possible fixes

Edited by Daphne Kua