0

I have a developer workstation provisioning script where I'm am attempting to clone out the base code devs work on.

However, when provisioning credentials to the git credential manager the script is throwing an error.

Script:

# configure git credential manager
git credential-manager-core configure

# add service account credentials to the credential manager; this is where it throws the error
printf "host=private.bitbucket.instance.example.com\nprotocol=https\nusername=GitServiceAccount@example.com\npassword=ComplexPassword" | git credential-manager-core store

# clone out code
git clone https://private.bitbucket.instance.example.com/path/developercode.git

# remove service account credentials from the credential manager
printf "host=private.bitbucket.instance.example.com\nprotocol=https\nusername=GitServiceAccount@example.com" | git credential-manager-core erase

Error:

fatal: Unable to persist credentials with the 'wincredman' credential store.
See https://aka.ms/gcm/credstores for more information.

The information page states "GCM is unable to persist credentials to the Windows Credential Manager due to limitations in Windows".

How can git credentials be stored for use in a provisioning script as seen above?

Matt Riley
  • 293
  • 1
  • 2
  • 16

1 Answers1

1

I don't use Windows, but I believe the Windows backend for the credential manager requires a logged in user with a graphical session, which is probably why this isn't working.

Instead, you can simply provide the credentials from the environment, as specified in the Git FAQ. Then, simply set the password or token in the proper environment variable and the operation will automatically use the proper credentials. This is also more secure in case some other Git operation happens at the same time, which will not have the password or token in the environment and will not be able to read the data from the credential helper.

The command to set the credential helper would be this (assuming your token is in $GIT_TOKEN):

$ git config --global credential.helper \
    '!f() { echo username=author; echo "password=$GIT_TOKEN"; };f'
bk2204
  • 64,793
  • 6
  • 84
  • 100
  • This worked perfectly, thanks! I removed references to credential manager and added the above. Then after the `git clone`, I unset the `credential.helper`. – Matt Riley Sep 27 '22 at 23:55