dotnet add package won't use credentials from global config for a source specified in local config

[evil-shrike]

Steps to reproduce

Given an internal Artifactory server with several repositories, all of them require authentication.

dotnet add package Microsoft.AspNetCore.All work for an arbitrary new project. That means that all cached credentials in "C:\Users\UserName\AppData\Roaming\NuGet\NuGet.Config" are fine.

That global NuGet.Config contains several sources:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageRestore>
    <add key="enabled" value="True" />
    <add key="automatic" value="True" />
  </packageRestore>
  <packageSources>
    <add key="rnd-virtual-dev" value="https://company.org/api/nuget/nuget-virtual-dev" />
    <add key="rnd-virtual" value="https://company.org/api/nuget/nuget-virtual" />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
  </packageSources>
  <activePackageSource>
    <add key="rnd-virtual" value="https://company.org/api/nuget/nuget-virtual" />
  </activePackageSource>
  <bindingRedirects>
    <add key="skip" value="False" />
  </bindingRedirects>
  <packageManagement>
    <add key="format" value="0" />
    <add key="disabled" value="True" />
  </packageManagement>
  <packageSourceCredentials>
    <rnd-virtual-dev>
      <add key="Username" value="username" />
      <add key="Password" value="AQA..." />
    </rnd-virtual-dev>
    <rnd-virtual>
      <add key="Username" value="username" />
      <add key="Password" value="AQA..." />
    </rnd-virtual>
  </packageSourceCredentials>
</configuration>

Now I'm adding a local NuGet.Config besides my csproj and try the same install: dotnet add package Microsoft.AspNetCore.All

It fails with 401 Unauthorized!

The local nuget.config contains one of the source from global config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
	<packageSources>
		<add key="Dev" value="https://company.org/api/nuget/nuget-virtual" />
	</packageSources>
</configuration>

If I run nuget.exe (4.6.2.5055) directly it works fine (that is it uses credentials from global config).

Expected behavior

Credentials are being used.

Actual behavior

Installation fails:

D:\Work\temp\testapp\Server>dotnet add package Microsoft.AspNetCore.All
  Writing C:\Users\UserName\AppData\Local\Temp\tmp2C0.tmp
info : Adding PackageReference for package 'Microsoft.AspNetCore.All' into project 'D:\Work\temp\testapp\Server\Server.csproj'.
log  : Restoring packages for D:\Work\temp\testapp\Server\Server.csproj...
info :   GET https://api.nuget.org/v3-flatcontainer/microsoft.aspnetcore.all/index.json
info :   GET https://company.org/api/nuget/nuget-virtual/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0
info :   GET https://company.org/api/nuget/nuget-virtual-dev/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0
info :   CACHE https://company.org/api/nuget/rnd-nuget/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0
info :   Unauthorized https://company.org/api/nuget/nuget-virtual/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0 100ms
log  : Retrying 'FindPackagesByIdAsyncCore' for source 'https://company.org/api/nuget/nuget-virtual/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0'.
log  : Response status code does not indicate success: 401 (Unauthorized).
info :   GET https://company.org/api/nuget/nuget-virtual/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0
info :   Unauthorized https://company.org/api/nuget/nuget-virtual/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0 3ms
log  : Retrying 'FindPackagesByIdAsyncCore' for source 'https://company.org/api/nuget/nuget-virtual/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0'.
log  : Response status code does not indicate success: 401 (Unauthorized).
info :   GET https://company.org/api/nuget/nuget-virtual/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0
info :   Unauthorized https://company.org/api/nuget/nuget-virtual/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0 3ms
error: Failed to retrieve information about 'Microsoft.AspNetCore.All' from remote source 'https://company.org/api/nuget/nuget-virtual/FindPackagesById()?id='Microsoft.AspNetCore.All'&semVerLevel=2.0.0'.
error:   Response status code does not indicate success: 401 (Unauthorized).

Environment data

dotnet --info output:

.NET Command Line Tools (2.1.200)

Product Information:
 Version:            2.1.200
 Commit SHA-1 hash:  2edba8d7f1

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.17134
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\2.1.200\

Microsoft .NET Core Shared Framework Host

  Version  : 2.0.7
  Build    : 2d61d0b043915bc948ebf98836fefe9ba942be11

PS: I double checked that the sources in local config and in global one are the same.

[livarcocc]

This issue was moved to NuGet/Home#6935