0

I need to work with Azure DevOps Repository (clone, push, pull) from non-interactive script. I've found only the solution to authenticate using PAT (https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows):

$MyPat = 'yourPAT'
$B64Pat = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("`:$MyPat"))
git -c http.extraHeader="Authorization: Basic $B64Pat" clone https://dev.azure.com/yourOrgName/yourProjectName/_git/yourRepoName

But I don't want to use Basic authentication. Are there more secure solutions?

Expect to authenticate using OAuth by service principal using client credentials flow to generate access token and use it in http.extraHeader

dan1st
  • 12,568
  • 8
  • 34
  • 67
dizen
  • 1
  • Note that basic authentication with a restricted PAT is not _inherently_ insecure. – dan1st Nov 28 '22 at 16:01
  • Hi @dan1st, like the follow answer says, the PAT isn't an insecure authenticated way. And here for Azure devops services repo authentication, if you don't want to use PAT, you could see whether [SSH authentication](https://learn.microsoft.com/en-us/azure/devops/repos/git/auth-overview?view=azure-devops#ssh-key-authentication) could meet your requirements. Thanks. – Antonia Wu-MSFT Nov 29 '22 at 03:39

1 Answers1

2

In general, Git doesn't offer many complicated ways to authenticate. For example, using some technique to sign a request is difficult because the body is streamed and not known beforehand, so it can't be signed.

Git, through libcurl, knows how to do Basic, Digest, NTLM, and Kerberos authentication. Digest and NTLM are both problematic because they most often use broken cryptography and require credentials to be stored in an insecure way. Kerberos is secure, but it requires that you're part of a Kerberos realm and it's tricky to use in a non-interactive way.

That leaves Basic. Since you're using HTTPS, your data is protected from being read or tampered with, and so Basic is a secure approach. It is recommended to limit the scope of the personal access token as much as possible to limit the damage if it's exposed.

Note that you should prefer to avoid passing credentials via http.extraheader because that causes various things to break and isn't very secure because we assume anyone on the same machine can read all command-line arguments. Instead, expose the PAT through the environment and use the technique outlined in the Git FAQ to read it from there, which is more secure.

bk2204
  • 64,793
  • 6
  • 84
  • 100