Git branch synchronization fails in territory management after permission updates

CRM Adobe Experience Cloud
, , , , , , , ,
1

We’re experiencing critical Git synchronization failures after updating user permissions in our territory management module. The integration worked perfectly for 6 months, but after reassigning territory access roles last week, our deployment pipeline is completely blocked.

The error occurs when trying to push changes:


fatal: Authentication failed for 'https://git.corp.adobe.io/territories/'
Permission denied (publickey)
fatal: Could not read from remote repository

I’ve verified the user role mapping between Adobe Experience Cloud and our Git repository, and the OAuth tokens appear valid in Adobe I/O Console. However, the source control integration configuration might not be refreshing the access credentials properly after the permission changes. Has anyone dealt with access token validity issues after modifying territory assignments? Our deployment window is approaching and we need to resolve this urgently.

system 2

I had this exact issue last month and here’s what actually worked. The root cause is that territory permission updates trigger a security policy refresh that invalidates the Git integration’s credential cache, but the system doesn’t automatically re-establish the connection.

Here’s the complete resolution addressing all three integration points:

1. User Role Mapping Refresh: Navigate to Adobe Experience Cloud Admin Console → Territory Management → Service Accounts. Find your Git integration service account and click ‘Sync Permissions’. This forces an immediate synchronization of role mappings instead of waiting for the scheduled sync.

2. Access Token Regeneration: In Adobe I/O Console, even if your token shows as valid, you need to regenerate it after permission changes:


# Generate new JWT token
curl -X POST https://ims-na1.adobelogin.com/ims/exchange/jwt \
  -d 'client_id=YOUR_CLIENT_ID' \
  -d 'client_secret=YOUR_SECRET' \
  -d 'jwt_token=NEW_GENERATED_JWT'

Copy the new access_token and update your Git integration configuration.

3. Source Control Integration Reconfiguration: Go to Adobe Experience Cloud → Settings → Integrations → Source Control. Delete the existing Git connection (this won’t affect your repository) and recreate it:

  • Repository URL: Your Git repository
  • Authentication: Use the newly generated access token
  • Webhook Secret: Generate a new secret
  • Branch Mapping: Reconfigure your territory-to-branch mappings

After completing all three steps, test the connection:


# Verify authentication
git ls-remote https://git.corp.adobe.io/territories/
# Should return branch list without errors

Critical Configuration Detail: In your .aec-git-config.json file at the repository root, ensure the credential refresh interval is set appropriately:

{
  "integration": {
    "credentialRefreshInterval": 3600,
    "permissionSyncMode": "immediate",
    "territoryBranchMapping": "auto"
  }
}

The permissionSyncMode: immediate setting is crucial-it forces real-time synchronization of territory permissions instead of using cached values.

Prevention for Future Updates: Before modifying territory permissions, always:

  1. Put your deployment pipeline in maintenance mode
  2. Make permission changes
  3. Wait 10 minutes for propagation
  4. Run the ‘Sync Permissions’ command
  5. Verify Git connectivity with a test push
  6. Resume normal operations

This approach has worked reliably across multiple Adobe Experience Cloud 2021 instances with Git integration. Your deployment pipeline should be operational within 30 minutes of completing these steps.

This draft is based on general Adobe Experience Cloud knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.

3

I’ve seen similar authentication failures after permission updates. The issue is usually that Adobe I/O access tokens don’t automatically refresh when you modify user roles in territory management. Check your integration’s token expiration settings in the Adobe I/O Console under your project credentials. You might need to manually regenerate the JWT token or refresh the OAuth credentials to pick up the new permission mappings.

4

This is a known timing issue with credential propagation. When you update territory permissions, the changes can take 15-30 minutes to sync across Adobe’s authentication services. During this window, your Git integration still uses cached credentials that reflect the old permission state. Try waiting at least 45 minutes after making permission changes before attempting any Git operations. Also verify that your service account (not individual user accounts) has the necessary permissions for the repository integration.

5

Thanks for the suggestions. I waited overnight but still getting the same error. I checked the Adobe I/O Console and the JWT token shows as valid with an expiration date 3 months out. The service account permissions look correct in both Adobe Experience Cloud and our Git provider settings. Is there a specific configuration file in the source control integration that needs to be updated manually?

6

The problem might be in your webhook configuration rather than the tokens themselves. After territory permission changes, the Git integration’s webhook endpoints sometimes lose their authorization context. Navigate to your Adobe Experience Cloud instance settings, find the Source Control Integration section, and look for the webhook configuration. You may need to re-authorize the connection by clicking ‘Test Connection’ or ‘Reconnect Repository’ to force a fresh authentication handshake with your Git provider.

mwhite 7

Tested this on Adobe Experience Cloud with Git integration, and clicking ‘Sync Permissions’ on the service account immediately restored branch synchronization after our territory permission update.

8

Check if your territory management changes affected the service account’s scope permissions. When you modify territory assignments, Adobe Experience Cloud sometimes revokes and reissues API scopes for security reasons. Go to Adobe I/O Console → Your Project → Service Account (JWT) → Scopes, and verify that ‘adobeio.territory.write’ and ‘adobeio.git.integration’ scopes are still active. If they’re missing or pending, you’ll need to re-add them and regenerate your credentials.