Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Git is always asking for credentials for every pull/push using an app password on Bitbucket #1307

Closed
FTeik opened this issue Jun 27, 2023 · 4 comments
Labels
auth-issue An issue authenticating to a host

Comments

@FTeik
Copy link

FTeik commented Jun 27, 2023

Version

2.1.2

Operating system

Windows

OS version or distribution

Windows 11 x64

Git hosting provider(s)

Bitbucket Cloud

Other hosting provider

No response

(Azure DevOps only) What format is your remote URL?

None

Can you access the remote repository directly in the browser?

Yes, I can access the repository

Expected behavior

When doing git remote operations (pull, fetch and push) I expect to get asked only the first time for the password and any remote operation later will use the stored credential information and does not ask for a password again.

Actual behavior

My current setup is:

Windows 11 , Git version 2.41.0.windows.1 and the Bitbucket git credentials are the user name and the personall access token.

Git is configured to use the Win credential store. Here is my git config:

$ git config --list
diff.astextplain.textconv=astextplain
http.sslbackend=schannel
core.autocrlf=true
core.fscache=true
core.symlinks=false
core.editor="C:\Program Files\Notepad++\notepad++.exe" -multiInst -notabbar -nosession -noPlugin
pull.rebase=false
credential.helper=manager
credential.https://dev.azure.com.usehttppath=true
init.defaultbranch=master
user.name=xxxx
user.email=xxxx
credential.helper=
credential.helper=manager
credential.bitbucketauthmodes=basic
credential.https://dev.azure.com.usehttppath=true
core.repositoryformatversion=0
core.filemode=false
core.bare=false
core.logallrefupdates=true
core.symlinks=false
core.ignorecase=true

In the Win credential manager I can see an entry 'git:https://bitbucket.org/' with my bitbucket username. After deleting that entry and doing a git pull and entering my credential it reappears in the credential manager. So it seems to be stored correctly. But is not used in subsequent git pull/push operations.

My repo url is in the following format:

remote.origin.url=https://@bitbucket.org/xxxxx/xxx.git

With or without 'credential.bitbucketauthmodes=basic' asking for credential is the same except the dialog for the credetials looks different.

Any ideas how to get it working?

Logs

Diagnose log at 2023-06-27T06:10:27Z

AppPath: C:\Program Files\Git\mingw64\bin\git-credential-manager.exe
InstallDir: C:\Program Files\Git\mingw64\bin
Version: 2.1.2


Diagnostic: Environment
Skipped: False
Success: True
Exception: None
Log:
OSType: Windows
OSVersion: 10.0 (build 22621)
Reading environment variables... OK
Variables:
HOMEPATH=\Users\XXXXX
DriverData=C:\Windows\System32\Drivers\DriverData
MSYSTEM=MINGW64
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
ProgramFiles(x86)=C:\Program Files (x86)
CONFIG_SITE=C:/Program Files/Git/etc/config.site
LC_CTYPE=de_DE.UTF-8
TERM_PROGRAM=mintty
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
ORIGINAL_TEMP=C:/Users/XXXXX/AppData/Local/Temp
USERNAME=XXXXX
MINGW_PREFIX=C:/Program Files/Git/mingw64
GIT_EXEC_PATH=C:/Program Files/Git/mingw64/libexec/git-core
ACLOCAL_PATH=C:\Program Files\Git\mingw64\share\aclocal;C:\Program Files\Git\usr\share\aclocal
TEMP=C:\Users\XXXXX\AppData\Local\Temp
LOCALAPPDATA=C:\Users\XXXXX\AppData\Local
MANPATH=C:\Program Files\Git\mingw64\local\man;C:\Program Files\Git\mingw64\share\man;C:\Program Files\Git\usr\local\man;C:\Program Files\Git\usr\share\man;C:\Program Files\Git\usr\man;C:\Program Files\Git\share\man
TERM=xterm
PROCESSOR_IDENTIFIER=AMD64 Family 25 Model 97 Stepping 2, AuthenticAMD
MSYSTEM_CARCH=x86_64
PROGRAMFILES=C:\Program Files (x86)
ProgramData=C:\ProgramData
TERM_PROGRAM_VERSION=3.6.4
ORIGINAL_TMP=C:/Users/XXXXX/AppData/Local/Temp
PROCESSOR_REVISION=6102
SYSTEMROOT=C:\Windows
POWERSHELL_DISTRIBUTION_CHANNEL=MSI:Windows 10 Pro
PROCESSOR_LEVEL=25
NUMBER_OF_PROCESSORS=32
SSH_ASKPASS=C:/Program Files/Git/mingw64/bin/git-askpass.exe
SHLVL=1
APPDATA=C:\Users\XXXXX\AppData\Roaming
SYSTEMDRIVE=C:
PSModulePath=C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules
PUBLIC=C:\Users\Public
FPS_BROWSER_USER_PROFILE_STRING=Default
PKG_CONFIG_PATH=C:\Program Files\Git\mingw64\lib\pkgconfig;C:\Program Files\Git\mingw64\share\pkgconfig
USERDOMAIN_ROAMINGPROFILE=DESKTOP-0PP58T6
MSYSTEM_CHOST=x86_64-w64-mingw32
WINDIR=C:\Windows
PLINK_PROTOCOL=ssh
INFOPATH=C:\Program Files\Git\mingw64\local\info;C:\Program Files\Git\mingw64\share\info;C:\Program Files\Git\usr\local\info;C:\Program Files\Git\usr\share\info;C:\Program Files\Git\usr\info;C:\Program Files\Git\share\info
ProgramW6432=C:\Program Files
PATH=C:/Program Files/Git/mingw64/libexec/git-core;C:\Users\XXXXX\bin;C:\Program Files\Git\mingw64\bin;C:\Program Files\Git\usr\local\bin;C:\Program Files\Git\usr\bin;C:\Program Files\Git\usr\bin;C:\Program Files\Git\mingw64\bin;C:\Program Files\Git\usr\bin;C:\Users\XXXXX\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Windows\System32\OpenSSH;C:\Program Files\Microsoft SQL Server\150\Tools\Binn;C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn;C:\Program Files\PowerShell\7;C:\Program Files\dotnet;C:\Program Files\Git\cmd;C:\Users\XXXXX\AppData\Local\Microsoft\WindowsApps;C:\Users\XXXXX.dotnet\tools;C:\Program Files\Git\usr\bin\vendor_perl;C:\Program Files\Git\usr\bin\core_perl
MINGW_CHOST=x86_64-w64-mingw32
GIT_TRACE2_PARENT_SID=f49bf5d7-b33e-4531-8c57-34d0014e6e3f
FPS_BROWSER_APP_PROFILE_STRING=Internet Explorer
PKG_CONFIG_SYSTEM_LIBRARY_PATH=C:/Program Files/Git/mingw64/lib
TMPDIR=C:\Users\XXXXX\AppData\Local\Temp
TMP=C:\Users\XXXXX\AppData\Local\Temp
SHELL=C:\Program Files\Git\usr\bin\bash.exe
HOME=C:\Users\XXXXX
COMSPEC=C:\Windows\system32\cmd.exe
LOGONSERVER=\DESKTOP-0PP58T6
USERPROFILE=C:\Users\XXXXX
DISPLAY=needs-to-be-defined
COMMONPROGRAMFILES=C:\Program Files (x86)\Common Files
EFC_6604=1
CommonProgramW6432=C:\Program Files\Common Files
HOMEDRIVE=C:
MSYSTEM_PREFIX=C:/Program Files/Git/mingw64
MINGW_PACKAGE_PREFIX=mingw-w64-x86_64
SESSIONNAME=Console
EXEPATH=C:\Program Files\Git
PROCESSOR_ARCHITEW6432=AMD64
ORIGINAL_PATH=C:\Program Files\Git\mingw64\bin;C:\Program Files\Git\usr\bin;C:\Users\XXXXX\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Windows\System32\OpenSSH;C:\Program Files\Microsoft SQL Server\150\Tools\Binn;C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn;C:\Program Files\PowerShell\7;C:\Program Files\dotnet;C:\Program Files\Git\cmd;C:\Users\XXXXX\AppData\Local\Microsoft\WindowsApps;C:\Users\XXXXX.dotnet\tools
PROCESSOR_ARCHITECTURE=x86
PS1=[\033]0;$TITLEPREFIX:$PWD\007]\n[\033[32m]\u@\h [\033[35m]$MSYSTEM [\033[33m]\w[\033[36m]__git_ps1[\033[0m]\n$
OS=Windows_NT
PKG_CONFIG_SYSTEM_INCLUDE_PATH=C:/Program Files/Git/mingw64/include
_=C:/Program Files/Git/mingw64/bin/git
ALLUSERSPROFILE=C:\ProgramData


Diagnostic: File system
Skipped: False
Success: True
Exception: None
Log:
Temporary directory is 'C:\Users\XXXXX\AppData\Local\Temp'...
Checking basic file I/O...
Writing to temporary file 'C:\Users\XXXXX\AppData\Local\Temp\68aa4edd90c393edfedb407a'... OK
Reading from temporary file 'C:\Users\XXXXX\AppData\Local\Temp\68aa4edd90c393edfedb407a'... OK
Deleting temporary file 'C:\Users\XXXXX\AppData\Local\Temp\68aa4edd90c393edfedb407a'... OK
Testing IFileSystem instance...
UserHomePath: C:\Users\XXXXX
UserDataDirectoryPath: C:\Users\XXXXX.gcm
GetCurrentDirectory(): xxxxxxx


Diagnostic: Networking
Skipped: False
Success: True
Exception: None
Log:
Checking networking and HTTP stack...
Creating HTTP client... OK
IsNetworkAvailable: True
Sending HEAD request to http://example.com... OK
Sending HEAD request to https://example.com... OK
Acquiring free TCP port... OK
Testing local HTTP loopback connections...
Creating new HTTP listener for http://localhost:50681/... OK
Waiting for loopback connection... OK
Writing response... OK
Waiting for response data... OK
Loopback connection data OK


Diagnostic: Git
Skipped: False
Success: True
Exception: None
Log:
Getting Git version... OK
Git version is '2.41.0.windows.1'
Locating current repository... OK
Git repository at 'xxxxxxx'
Listing all Git configuration... OK
Git configuration:
file:C:/Program Files/Git/etc/gitconfig diff.astextplain.textconv=astextplain
file:C:/Program Files/Git/etc/gitconfig http.sslbackend=schannel
file:C:/Program Files/Git/etc/gitconfig core.autocrlf=true
file:C:/Program Files/Git/etc/gitconfig core.fscache=true
file:C:/Program Files/Git/etc/gitconfig core.symlinks=false
file:C:/Program Files/Git/etc/gitconfig core.editor="C:\Program Files\Notepad++\notepad++.exe" -multiInst -notabbar -nosession -noPlugin
file:C:/Program Files/Git/etc/gitconfig pull.rebase=false
file:C:/Program Files/Git/etc/gitconfig credential.helper=manager
file:C:/Program Files/Git/etc/gitconfig credential.https://dev.azure.com.usehttppath=true
file:C:/Program Files/Git/etc/gitconfig init.defaultbranch=master
file:C:/Users/XXXXX/.gitconfig user.name=XXXXXe
file:C:/Users/XXXXX/.gitconfig user.email=XXXXXe
file:C:/Users/XXXXX/.gitconfig credential.helper=
file:C:/Users/XXXXX/.gitconfig credential.helper=manager
file:C:/Users/XXXXX/.gitconfig credential.bitbucketauthmodes=basic
file:C:/Users/XXXXX/.gitconfig credential.https://dev.azure.com.usehttppath=true
file:.git/config core.repositoryformatversion=0
file:.git/config core.filemode=false
file:.git/config core.bare=false
file:.git/config core.logallrefupdates=true
file:.git/config core.symlinks=false
file:.git/config core.ignorecase=true
file:.git/config remote.origin.url=https://XXXXX@bitbucket.org/workspace/repo.git
file:.git/config remote.origin.fetch=+refs/heads/:refs/remotes/origin/
file:.git/config branch.master.remote=origin
file:.git/config branch.master.merge=refs/heads/master
file:.git/config branch.develop.remote=origin
file:.git/config branch.develop.merge=refs/heads/develop
file:.git/config branch.tciBranding.remote=origin
file:.git/config branch.tciBranding.merge=refs/heads/tciBranding


Diagnostic: Credential storage
Skipped: False
Success: True
Exception: None
Log:
ICredentialStore instance is of type: CredentialStore
Writing test credential... OK
Reading test credential... OK
Deleting test credential... OK


Diagnostic: Microsoft authentication (AAD/MSA)
Skipped: False
Success: True
Exception: None
Log:
Broker is not enabled.
Flow type is: Auto
Gathering MSAL token cache data... OK
CacheDirectory: C:\Users\XXXXX\AppData\Local.IdentityService
CacheFileName: msal.cache
CacheFilePath: C:\Users\XXXXX\AppData\Local.IdentityService\msal.cache
Creating cache helper... OK
Verifying MSAL token cache persistence... OK


Diagnostic: GitHub API
Skipped: False
Success: True
Exception: None
Log:
Using 'https://github.com/' as API target.
Querying '/meta' endpoint... OK

@FTeik FTeik added the auth-issue An issue authenticating to a host label Jun 27, 2023
@mjcheetham
Copy link
Collaborator

Hello @FTeik!

Can you verify that the app password you are using has all of the following permissions:

image

If your password/token is missing the Account:Read permission, then I can reproduce this behaviour.

@FTeik
Copy link
Author

FTeik commented Jul 4, 2023

Hi,

yes that are the permissions I'm using. My git acces works perfectly fine. But for every remot operation (fetch/pull/push) I have to enter the long and non memorable app password. Thats why I want to use the git credential manager. This was working perfectly fine until I switched from Win10 to Win11. The other difference was the git version as on Win 11 I installed the latest git version. Under Win10 in the git config as credential.helper I saw 'wincred' now its 'manager'.
What I also observe is the different appearence of the password dialog. Disabling the git credential manager I get a simple grey dialog just asking for the password. When using the credential helper I get an Atlassian dialog where I can select either to use the browser or user/pwd. After entering the password and getting a succesful pull I can also see to popup a new entry in the Windows credential manager named git:https://bitbucket.org. So from my perspective the credentials are stored. But not used for the next rempte git operation as it asks me again.

@FTeik
Copy link
Author

FTeik commented Jul 4, 2023

Hi again,

as I could not verify the permissins I set 1.5 years ago it was only an assumption that I set the correct permissions, as it was working all the time before.
To verify the permissions I created a new app password and indeed after setting the account read permission its working now.
You really saved my day, thank you very much.
As a conclusion there is a change in the interaction with Atlassian and the new Git credential manager (or Win11) which needs the account read access. Still not clear why this is necessary, as Git without the credential manager can authenticate without having the account read permission.

Thx

@ldennington
Copy link
Contributor

The extra scope is required to check that the token is still valid and to resolve the username associated with the credential.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auth-issue An issue authenticating to a host
Projects
None yet
Development

No branches or pull requests

3 participants