Visual Studio 2022 Copilot for Business behind corporate proxy

[VitalijsDraba]

Select Topic Area

Question

Body

I have a Copilot for Business subscription and have successfully enabled the VSCode Copilot plugin.

However, I am encountering a problem with the Visual Studio 2022 Copilot plugin (https://marketplace.visualstudio.com/items?itemName=GitHub.copilotvs)
Specifically, it appears to be ignoring the proxy authentication when attempting to use it behind a corporate proxy.

I am wondering if there is a way to configure the Visual Studio Copilot plugin to work with the corporate proxy.

The error present in the log is as follows:

    <type>Information</type>
    <source>GitHub.Copilot</source>
    <description>An error occurred for &apos;RunOperation:SignInInitiateAsync&apos;: StreamJsonRpc.RemoteInvocationException: Request signInInitiate failed with message: tunneling socket could not be established, statusCode=407&#x000D;&#x000A;   at StreamJsonRpc.JsonRpc.&lt;InvokeCoreAsync&gt;d__143`1.MoveNext()&#x000D;&#x000A;--- End of stack trace from previous location where exception was thrown ---&#x000D;&#x000A;   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()&#x000D;&#x000A;   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)&#x000D;&#x000A;   at GitHub.Copilot.CopilotClient.&lt;RunOperation&gt;d__20`1.MoveNext()</description>

[Akash1134]

Hi @VitalijsDraba ,

You're getting error 407 which means we're hitting your proxy but it's expecting us to authenticate, which we are not doing. Visual Studio doesn't offer proxy settings in the app, but uses the Windows system settings.

Copilot has to make a lot of calls, so simply getting past the authentication process isn't enough - Copilot has to be able to call home reliably to work, and the proxy is in the way.

Is there a way you can find out what kind of authentication your proxy is looking for (basic, NTLM, etc)?

Thanks!

[VitalijsDraba]

We use NTLM authentication on our proxy.

The proxy settings currently configured for VSCode
"http.proxy": "http://username:password@proxy:port",

[VitalijsDraba]

Hi @Akash1134 ,

I was wondering if there has been any progress regarding the matter we discussed earlier?

Thanks!

[Akash1134]

Hi @VitalijsDraba ,

You can finetune your network using the following endpoints in the firewall rules:

https://github.com/login/device/code
hitps://github.com/login/oauth/access_token
hitps://api.github.com/user
https://api.github.com/copilot_internal/v2/token
https://api.github.com/copilot_internalnotification
hitps://default.exp-tas.com
https://copilottelemetry.githubusercontent.com/telemetry
https://copilot-proxy.githubusercontent.com

Hope that helps!

[VitalijsDraba]

I can access all the endpoints from command line with no issues.
The issue is that copilot.vs did not use proxy authentication headers or http_proxy environment variables.

[ricNr1]

I'm having the same issue. I have no problem getting past our proxy when using visual studio to fetch pull and push my github repository. But the copilot somehow does not get past the proxy.

[Akash1134]

Hi @ricNr1 Are you getting any specific error message or does it just does not move past the login?

[ricNr1]

I get this message in the copilot Logging:
[INFO] [default] [2023-03-31T07:54:39.972Z] [fetchCompletions] engine https://copilot-proxy.githubusercontent.com/v1/engines/copilot-codex
statusNotification: Warning
[ERROR] [default] [2023-03-31T07:54:40.089Z] Request Error: tunneling socket could not be established, statusCode=407
[ERROR] [ghostText] [2023-03-31T07:54:40.090Z] Error on ghost text request FetchError: tunneling socket could not be established, statusCode=407
[INFO] [RequestProposalsAsync] 0 completions available.

[the-iron-ryan]

I am also experiencing this issue where I'm unable to use/sign in to github copilot underneath my work's proxy. We also use a NTLM proxy.

I have my 'http_poxy' and 'https_proxy' environment variables set correctly (with user and password credentials). Settings these is usually the solution to most proxy problems. However, it doesn't seem that copilot reads from these since I'm still getting a 407 error when attempting to sign in.

[Akash1134]

Hi @the-iron-ryan ,

A 407 error means that the proxy is requesting authentication and you are either not offering credentials or the credentials are incorrect. Please note that at present, we support basic authentication, and proxy settings can be set in VSCode and IntelliJ IDEs. Visual Studio uses the system proxy settings.

Have you set up your proxy authentication using this VSCode setting? If not, please check out this article for more details.

[the-iron-ryan]

I'm using Visual Studio Enterprise 2022 and not VSCode. How do I go about authenticating my proxy in VS 2022? I haven't been able to find a solution to this.

[Akash1134]

Hi All, Sorry that I missed this conversation. I will discuss this with our engineers internally and provide more details.

[dnielsen2022]

@Akash1134 Any updates?

[McMlok]

Hello All, I have similar problem. Copilot in Visual Studio 2022 (Windows 10) is unable to sign in with HTTP 407 from our corporation proxy. Proxy accepts only NTLMv2 or Kerberos tickets.

I'm using pre proxy for authentication on our corporate proxy but I don't know how to setup this proxy for Copilot in Visual Studio 2022. When I set pre proxy in JetBrains Raider or VSCode Copilot works. I also pointed ALL|HTTP|HTTPS_PROXY to the pre proxy but without luck.

[zimmerad]

We are experiencing the same issue on Intellij 2022.1.4, plugin version 1.2.5.2507, copilot for business.

[Markus1980Wien]

Is there any progress on this issue?
Many corporate users with Visual Studio Professional or Enterprise are behind a NTLM proxy.

[Akash1134]

Hi everyone,

Visual Studio currently only supports proxies through the Windows system settings and not editor-specific settings. This means that that Visual Studio currently does not support basic authentication for proxies. GitHub Copilot for Business requires an active internet connection between a user’s IDE and the GitHub Copilot Proxy service and, at the moment, VPN proxy support via self-signed certificates is only available for VS Code and JetBrains IDEs.

We are working and experimenting with proxies with NTLM authentication specially with VS and will update this thread once we have more details to share.

Thanks!

[szqsy17]

any updates?

[ayim]

@ChaoquanTao @szqsy17 if you are using a proxy that uses NTLM to authenticate, the current suggested workaround is using a local forwarding proxy (i.e. winfoom).

If you use winfoom, environment variables HTTP_PROXY and HTTPS_PROXY need to be set to point at the local forwarding proxy.

[phinke]

Hello @Akash1134,
according to the documentation of VS2022 proxy configuration is indeed supported. An example for configuration can be found here.

The problem is not that Visual Studio doesn't support it, the problem is that the implementation of Copilot doesn't support this / doesn't make use of this official configuration method.

[asmorodin86]

Спасибо Аим, твои рекомендации действительно работают! Спасибо! Проверено, рекомендую!

[asmorodin86]

Thank you Ayim, your recommendations really work! Thank you! Checked, I recommend!

[mohamedbadr]

any progress folks?

This solution worked for me
https://stackoverflow.com/questions/75898544/visual-studio-2022-coplit-showyour-current-copilot-license-doesnt-support-prox

• Open Edge browser and navigate to github.com
• Open certificate details (icon left to page url) then go to second tab in cert viewer
• Export cert - save as chain (choose 'save as type'[chain - second in the list] in a 'save as' window) - it should be in PEM format (type extension manually)
• Add system variable (NODE_EXTRA_CA_CERTS) with path to the PEM file.

[fdomoreno]

@mohamedbadr Thank you very much, I had the same problem, but this solution and adding the environment variables http_proxy and https_proxy worked for me.

Thank you very much!

[jcadafalch]

@mohamedbadr It still works in April 2024, thank you very much.

[paulobndes]

I believe that a simpler solution is just to put in your settings.json file:

   "http.proxyStrictSSL": false,

[paulobndes]

I'm behind a corporate proxy that authenticates via NTLM. Since version 1.15 VSCode has NTLM authentication. There's no need to configure anything. It just works for downloading and updating extensions. As the web browsers, it gets all the necessary info for proxy authentication from my logged Windows session.

Unfortunately I couldn't make GitHub Copilot to work.

It looks like that VSCode proxy isn't used by extensions. They use the note https module. There is even a extension to test extensions internet access

VSCode has an open bug from 2016 to make extensions use the same proxy configuration. The newest message says that maybe someday they will implement it, but NTLM isn't in the near sight.

It looks like the only way to use it is to configure a local authentication proxy like:

1. px
2. crash prone cntlm
3. winfoom looks like it can get auth info from Windows session. No need to configure passwords.
4. fiddler

Using a local proxy makes our dev environment much more complex. We need to configure http_proxy and https_proxy environment variables. Also configure no_proxy to access internal resources. Every time the user changes her password, she must reconfigure the local proxy. Hell.

This is a problem not just with the "Copilot for Business" , but with Copilot in any corporate setup.

This message is just a pledge for GitHub to put some resources to help solve this problem, and a warn for fellow developers that there isn't a simple solution for NTLM authentication.