This repository has been archived by the owner on Jul 15, 2023. It is now read-only.
GCM does not recover from reset password #793
Comments
|
Here is the workflow and it's an interesting problem: For NTLM, GCM doesn't validate or store credentials. It requires on your OS to manage NTLM connections. NTML isn't valided in GCM (nor is easy to validate for all cases). We believe the time which you see this would be during a password reset, which would hopefully be infrequent. |
|
Wouldn't it be reasonable for GCM to try basic authentication after NTLM failed? Or are you saying GCM doesn't have a chance to do that, like it doesn't even know the authentication failed?
|
|
For a "Get" call, GCM just returns your NTML credentials. It doesn't try to use them and doesn't see the fail. |
|
Hi my team is also experiencing the same issue when changing passwords. What is the resolution? @sergiopereira could you share how you set the Authority to Basic? |
|
@seanfisher all the avenues I explored to get some help, including this thread were dead-ends. My solution was to abandon this type of authentication and moving my entire team to SSH. The Windows Credential Manager has been our biggest headache for the last two years and I don't know if it's its fault. These days I do everything I can to not need it. |
|
Thanks @sergiopereira. I managed to find a solution that worked for me buried in the open issues here, of which there are several with this same problem (#703 #750 maybe more). The solution was to encode my username into the remote URL (I had to use the second option below): |
|
I ended up also changing the |
9 tasks
|
I'm seeing the same problem against a company-hosted Bitbucket Server instance. I'm on Windows 10 Pro Version 1909 build 18363.535, Git for Windows 2.24.1.windows.2, and GCM v1.20.0. My git config (with branch list removed) is as follows. I have one entry in Windows Credential Manager for gives the following error and does not updated the entry in Windows Credential Manager. With GIT_TRACE, GIT_TRACE2, and GCM_TRACE set to 2, I get the following output. I then applied the suggestion from the bottom of #817 (comment) which sets the username for that (all repos on) server -- rather than for a particular remote URL, as suggested at #793 (comment) above. This worked, with the log file below. I was prompted with the usual Windows password GUI, and now have a new entry in Windows Credential Store which has my username in the URL Furthermore I verified that, if I change my password, I get one round of I'll send this workaround out within my company but it would be good to have a fix. |
|
The issue is still unresolved to this day. Lets assume the remote url is set to As far as I can tell this is what happens:
And this is where the issue lies. When Git does not provide a username, the default credentials for the domain are always used for the lookup, but are never erased when authentication fails. The are two workarounds for the issue:
To resolve this I suggest the following change: |
|
Pull request #907 resolves this according to @marcohillenbrand's suggestion. This appears to be the same logic that Bitbucket auth already follows, so hopefully nothing here is too controversial. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Me and a few others that work together have been experiencing a recurring authentication problem when using GCM. We use TFS 2018 hosted inside our corporate network. Pretty much every time we have to change our network password we start getting authentication errors from TFS, sometimes even after removing every entry from the Windows Credential Manager (WCM) that contained a reference to the TFS server, sometimes a reboot fixes things, sometimes it doesn't.
In my particular situation I log into Windows using a local admin account, connect to VPN, and authenticate with the corporate network as needed, when servers prompt me for my network creds. I have the Git credential config like so:
I turned
GCM_TRACEon and this is what happens on agit fetch origin(I had no relevant entries in WCM):Shouldn't GCM prompt me for credentials after failing via NTLM? It seems stuck in this scenario where it detects NTLM support, fails, deletes (or tries to delete) old credentials, and doesn't fall back to Basic auth.
During experimentation, I set
credential.tfs2018.internal.mycorp.com.authoritytoBasicand that makes me get prompted for credentials (in the console, not with the modal pop-up.):This works and continues working without further prompts but I'm not sure there's some underlying problem that I'm just masking by doing this. I could maybe just ask all my team members to configure that last setting like I did but it doesn't seem reasonable. My expectation was that this kind of stuff should work transparently and auto-recover in scenarios like password reset.
Let me know if I can provide extra details.
The text was updated successfully, but these errors were encountered: