Chocolatey fails while connecting to secure source in remote session

[lavahot]

What You Are Seeing?

When using a remote powershell session (with either Enter-PSSession or Invoke-Command) and connecting to a TFS-hosted nuget feed source, the call fails with "Invalid credentials specified." repeated no less than 7 times. Using chocolatey on the machine directly works fine.

What is Expected?

To successfully connect to the source

How Did You Get This To Happen? (Steps to Reproduce)

Invoke-Command -ComputerName "MyLabMachine" -ScriptBlock {choco list -dv -s='http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' -u='bob' -p=PAT}

Output Log

Full Log Output

Chocolatey v0.10.11
Chocolatey is running on Windows v 10.0.14393.0
Attempting to delete file "C:/ProgramData/chocolatey/choco.exe.old".
Attempting to delete file "C:\ProgramData\chocolatey\choco.exe.old".
Command line not shown - sensitive arguments may have been passed.
RemovePendingPackagesTask is now ready and waiting for PreRunMessage.
Sending message 'PreRunMessage' out if there are subscribers...
[Pending] Removing all pending packages that should not be considered installed...
The source 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' evaluated to a 'normal' source type

NOTE: Hiding sensitive configuration data! Please double and triple
check to be sure no sensitive data is shown, especially if copying
output to a gist for review.
Configuration: CommandName='list'|CacheLocation='C:\chococache'|
ContainsLegacyPackageInstalls='True'|
CommandExecutionTimeoutSeconds='2700'|WebRequestTimeoutSeconds='30'|
Sources='http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'|

SourceType='normal'|Debug='True'|Verbose='True'|Trace='False'|
Force='False'|Noop='False'|HelpRequested='False'|
UnsuccessfulParsing='False'|RegularOutput='True'|QuietOutput='False'|
PromptForConfirmation='True'|AcceptLicense='False'|
AllowUnofficialBuild='False'|AllVersions='False'|
SkipPackageInstallProvider='False'|Prerelease='False'|ForceX86='False'|
OverrideArguments='False'|NotSilent='False'|
ApplyPackageParametersToDependencies='False'|
ApplyInstallArgumentsToDependencies='False'|IgnoreDependencies='False'|
AllowMultipleVersions='False'|AllowDowngrade='False'|
ForceDependencies='False'|Information.PlatformType='Windows'|
Information.PlatformVersion='10.0.14393.0'|
Information.PlatformName='Windows Server 2016'|
Information.ChocolateyVersion='0.10.11.0'|
Information.ChocolateyProductVersion='0.10.11'|
Information.FullName='choco, Version=0.10.11.0, Culture=neutral, PublicKeyToken=79d02ea9cad655eb'|

Information.Is64BitOperatingSystem='True'|
Information.Is64BitProcess='True'|Information.IsInteractive='False'|
Information.UserName='me'|
Information.UserDomainName='MYDOMAIN'|
Information.IsUserAdministrator='True'|
Information.IsUserSystemAccount='False'|
Information.IsUserRemoteDesktop='False'|
Information.IsUserRemote='True'|
Information.IsProcessElevated='True'|
Information.IsLicensedVersion='False'|Information.LicenseType='Foss'|
Features.AutoUninstaller='True'|Features.ChecksumFiles='True'|
Features.AllowEmptyChecksums='False'|
Features.AllowEmptyChecksumsSecure='True'|
Features.FailOnAutoUninstaller='False'|
Features.FailOnStandardError='False'|Features.UsePowerShellHost='True'|
Features.LogEnvironmentValues='False'|Features.LogWithoutColor='False'|
Features.VirusCheck='False'|
Features.FailOnInvalidOrMissingLicense='False'|
Features.IgnoreInvalidOptionsSwitches='True'|
Features.UsePackageExitCodes='True'|
Features.UseFipsCompliantChecksums='False'|
Features.ShowNonElevatedWarnings='True'|
Features.ShowDownloadProgress='True'|
Features.StopOnFirstPackageFailure='False'|
Features.UseRememberedArgumentsForUpgrades='False'|
Features.IgnoreUnfoundPackagesOnUpgradeOutdated='False'|
Features.RemovePackageInformationOnUninstall='False'|
Features.ScriptsCheckLastExitCode='False'|
ListCommand.LocalOnly='False'|
ListCommand.IdOnly='False'|ListCommand.IncludeRegistryPrograms='False'|
ListCommand.PageSize='25'|ListCommand.Exact='False'|
ListCommand.ByIdOnly='False'|ListCommand.ByTagOnly='False'|
ListCommand.IdStartsWith='False'|ListCommand.OrderByPopularity='False'|
ListCommand.ApprovedOnly='False'|
ListCommand.DownloadCacheAvailable='False'|
ListCommand.NotBroken='False'|
ListCommand.IncludeVersionOverrides='False'|
UpgradeCommand.FailOnUnfound='False'|
UpgradeCommand.FailOnNotInstalled='False'|
UpgradeCommand.NotifyOnlyAvailableUpgrades='False'|
UpgradeCommand.ExcludePrerelease='False'|
NewCommand.AutomaticPackage='False'|
NewCommand.UseOriginalTemplate='False'|SourceCommand.Command='unknown'|
SourceCommand.Username='bob'|SourceCommand.Priority='0'|
SourceCommand.BypassProxy='False'|
SourceCommand.AllowSelfService='False'|
SourceCommand.VisibleToAdminsOnly='False'|
FeatureCommand.Command='unknown'|ConfigCommand.Command='unknown'|
PinCommand.Command='unknown'|OutdatedCommand.IgnorePinned='False'|
Proxy.Location='http://myproxy:80'|
Proxy.BypassList='localhost,127.0.0.1,*.mydomain,mytfs,mytfs.mydomain'|

Proxy.BypassOnLocal='True'|
_ Chocolatey:ChocolateyListCommand - Normal Run Mode _
Searching for package information
Running list with the following filter = ''
--- Start of List ---
Using proxy server 'http://myproxy:80'.
Proxy has a bypass list of 'localhost,127.0.0.1,*.mydomain,mytfs,mytfs.mydomain'.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Invalid credentials specified.
Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'
Using passed in credentials
Sending message 'PostRunMessage' out if there are subscribers...
The remote server returned an error: (401) Unauthorized.

[lavahot]

Wait... Double-Hop?

[bcurran3]

I don't think this issue has anything at all to do with Chocolatey or choco.exe.

BUT, I think this might help you:
https://chocolatey.org/packages/bettertls-psmodule

[peterbarendse]

Same issue. @bcurran3 his proposal didn't fixed the issue.
Azure Devops Server (local): Version Dev17.M153.3
Choco version: v0.10.15

Any update on this issue?

[ferventcoder]

I believe this might be related to #1770.

[ferventcoder]

There is possibly a need for CredSSP here to get past double hop, but I think there may also be something else at play?