I use the Git Plugin to check out the repository. There I have configured an advanced submodule behaviour, where I have checked the boxes for “recursively update submodules” and “use credentials from default remote of parent repo”.

If I now start a build, it tries to check out the submodule, but it fails with the following error message:

fatal: Cannot prompt because user interactivity has been disabled. 
remote: Invalid credentials 
fatal: Authentication failed for 'https://bitbucket.org/anoaou/libraries.git/'

My .gitmodules looks as follows:

[submodule "Logical/Libraries"]
    path = Logical/Libraries
    url = https://bitbucket.org/anoaou/libraries.git

(I had the same error when the URL had no .git at the end but only a /, and thought i had solved it when i saw it, bit it did nothing)

And yes, the credentials are correct, since the checkout does work for the main repo, but not for the submodule. Both are being checked out using HTTPS, with an app password from Bitbucket.

I believe this is due to the url not knowing who wants to access the submodule, even though the credentials are set in Jenkins.

Because the curious thing is, when I change the URL in .gitmodules to include the username of the used account, (same syntax as in the git clone command) it works. This is obviously a bad idea, since the other developers will then no longer be able to use the submodules.

I have scoured the internet for a solution, but most facing a similar error message have some sort of mix between SSH and HTTPS, or are not using an app password. I am once again at a loss about the weird ways of Jenkins.

I would like to avoid using SSH, just because our whole team would also have to switch over. If there is a solution where only the Jenkins Account needs SSH, I could live with that.

The Git Plugin is up to date as of posting this, and so is Jenkins and Git.