0

When connecting to my git repo I have to add authentication header git -c http.extraHeader="Authorization: Basic $b64pat" pull instead of git pull that fails

fatal: Authentication failed for 'https://xxxap01/xxxApps/xxxPreview/_git/xxxPreview/

This is my first question so foregive me and help me approve quality, thanks.

How can I make my Windows credentials work and get rid of cumbersome usage of PAT in every request?

The git repo is located on an on-prem Azure DevOps Server 2020 (due to governmental requirements) which I connect to using VPN client. Once connected, I can no longer access www/internet.

I can access https://xxxap01/xxxApps using my local browser but are of course prompted to enter my 'mysecuredomainaccount@securedomain.dk' and 'password' (the SSL cert is self signed but has been add to cert store of "Trusted Root Certification Authorities" (User).

DevOps Server is hosted on a Windows Server 2019, and the IIS IIS authentication - Basic Auth is not installed

I have added a generic credentials in the "Credential Manager" using the standard git syntax git:https://xxxap01/xxxApps and same 'mysecuredomainaccount@securedomain.dk' and 'password'

  1. git credential-manager unconfigure
  2. git config --global credential.helper wincred
  3. git credential-manager azure-repos list https://xxxap01/xxxApps OK: Shows ..> (global) -> mysecuredomainaccount@securedomain.dk

Running git pull results in this error in the log file gcm-diagnose.log:

ICredentialStore instance is of type: CredentialStore
Writing test credential... OK
Reading test credential... OK
Deleting test credential... OK
------------
Diagnostic: Microsoft authentication (AAD/MSA)
Skipped: False
Success: True
Exception: None
Log:
Broker not supported.
Flow type is: Auto
Gathering MSAL token cache data... OK
CacheDirectory: C:\Users\jrt\AppData\Local\.IdentityService
CacheFileName: msal.cache
CacheFilePath: C:\Users\jrt\AppData\Local\.IdentityService\msal.cache
Creating cache helper... OK
Verifying MSAL token cache persistence... OK
------------
Diagnostic: GitHub API
Skipped: False
Success: False
Exception:
System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The remote name could not be resolved: 'api.github.com'
   at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
   at System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)
   --- End of inner exception stack trace ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at GitHub.GitHubRestApi.<GetMetaInfoAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at GitHub.Diagnostics.GitHubApiDiagnostic.<RunInternalAsync>d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at GitCredentialManager.Diagnostics.Diagnostic.<RunAsync>d__5.MoveNext()
Log:
Using 'https://github.com/' as API target.
Querying '/meta' endpoint...
273K
  • 29,503
  • 10
  • 41
  • 64
  • If what you want it avoid having to set that on each git command, you can just set up the value with `git config http.extraHeader blahblahblah` (for that repo... or with `--global` so that it's a global thing for the user). – eftshift0 Jan 11 '23 at 12:46
  • You really should not use `http.extraHeader` for that when you could use a credential manager, since it's substantially less secure and result in double `Authorization` headers if you also use other creds, which can cause hard-to-diagnose problems. – bk2204 Jan 11 '23 at 22:09
  • @bk2204 Agree, I'm looking for a solution on how to fix my credential manager. I'll setup on another devbox and test from there. – Jørgen Thyme Jan 12 '23 at 08:13

0 Answers0