Git-credential-manager-for-windows: Can Not Authenticated

[thedavidscherer]

Installed GCM as part of the Git for Windows install (GCM was installed automatically by git installer).
Running Windows 10.
git version 2.12.1.windows.1
Using Bitbucket

Every time I try to do anything the credential manager pops up, I enter my username and password, submit, and in the CMD window I see fatal: Authentication failed for 'https://[email protected]/team/repo.git'

I know I'm typing the right user/pass combo as using the https://user:pass@bitbucket.... format works fine.

[whoisj]

Yikes!

@thedavidscherer could you set a couple of environment variables, and then reproduce your issue?

GIT_TRACE=%UserProfile%\Git.log
GCM_TRACE=%UserProfile%\Git.log

After you reproduce the issue, you can check the log file at %UserProfile%\Git.log and see if there's additional data available to you. Thanks!

[thedavidscherer]

Here is the output of the log file. Interestingly, I had to delete the saved credentials from Windows Credentials in Control Panel as it appears that using USER:PASS@Bitbucket format caused GCM to save the credentials.

15:38:36.921629 git.c:371               trace: built-in: git 'ls-remote' 'https://[email protected]/MY_COMPANY/REPO.git'
15:38:36.923125 run-command.c:369       trace: run_command: 'git-remote-https' 'https://[email protected]/MY_COMPANY/REPO.git' 'https://[email protected]/MY_COMPANY/REPO.git'
15:38:37.276192 run-command.c:369       trace: run_command: 'git credential-manager get'
15:38:37.342578 git.c:596               trace: exec: 'git-credential-manager' 'get'
15:38:37.343063 run-command.c:369       trace: run_command: 'git-credential-manager' 'get'
15:38:37.383255 ...\Program.cs:671      trace: [Main] git-credential-manager (v1.9.0) 'get'
15:38:37.420768 ...Configuration.cs:243 trace: [LoadGitConfiguration] git Portable, UserOnly config read, 18 entries.
15:38:37.446287 ...\Where.cs:231        trace: [FindGitInstallations] found 1 Git installation(s).
15:38:37.450288 ...Configuration.cs:243 trace: [LoadGitConfiguration] git All config read, 18 entries.
15:38:37.453290 ...\Program.cs:686      trace: [EnableTraceLogging] trace logging enabled.
15:38:37.454291 ...\Program.cs:702      trace: [EnableTraceLogging] git global config found at 'C:\Users\dscherer\.gitconfig'.
15:38:37.455792 ...\Program.cs:737      trace: [EnableTraceLogging] trace log destination is 'C:\Users\dscherer'.
15:38:37.470803 ...\Program.cs:384      trace: [CreateAuthentication] detecting authority type for 'https://bitbucket.org/'.
15:38:37.480812 ...uthentication.cs:131 trace: [GetAuthentication] not github.com, authentication creation aborted.
15:38:37.481311 ...\Program.cs:463      trace: [CreateAuthentication] authority for 'https://bitbucket.org/' is basic with NTLM=Never.
15:38:37.492818 ...uthentication.cs:132 trace: [AcquireCredentials] prompting user for credentials for 'https://bitbucket.org/'.
15:38:45.014466 ...\Program.cs:1284     trace: [ModalPromptDisplayDialog] successfully acquired credentials from user.
15:38:45.014967 ...\Program.cs:1001     trace: [QueryCredentials] credentials found.
15:38:45.238066 run-command.c:369       trace: run_command: 'git credential-manager erase'
15:38:45.299624 git.c:596               trace: exec: 'git-credential-manager' 'erase'
15:38:45.300125 run-command.c:369       trace: run_command: 'git-credential-manager' 'erase'
15:38:45.340661 ...\Program.cs:671      trace: [Main] git-credential-manager (v1.9.0) 'erase'
15:38:45.381685 ...Configuration.cs:243 trace: [LoadGitConfiguration] git Portable, UserOnly config read, 18 entries.
15:38:45.407707 ...\Where.cs:231        trace: [FindGitInstallations] found 1 Git installation(s).
15:38:45.411210 ...Configuration.cs:243 trace: [LoadGitConfiguration] git All config read, 18 entries.
15:38:45.414210 ...\Program.cs:686      trace: [EnableTraceLogging] trace logging enabled.
15:38:45.415209 ...\Program.cs:702      trace: [EnableTraceLogging] git global config found at 'C:\Users\dscherer\.gitconfig'.
15:38:45.416210 ...\Program.cs:737      trace: [EnableTraceLogging] trace log destination is 'C:\Users\dscherer'.
15:38:45.417195 ...\Program.cs:233      trace: [Erase] preserve = true, canceling erase request.

[whoisj]

Thansk!

Ok so...

Git asks for credentials, and the GCM prompts you for credentials.

15:38:37.383255 ...\Program.cs:671 trace: [Main] git-credential-manager (v1.9.0) 'get'
15:38:37.492818 ...uthentication.cs:132 trace: [AcquireCredentials] prompting user for credentials for 'https://bitbucket.org/'

You enter them, and GCM gives them back to Git. Git claims that they're no good, and tells GCM to erase them it recorded them.

15:38:45.340661 ...\Program.cs:671 trace: [Main] git-credential-manager (v1.9.0) 'erase'

Ah-ha, looks like preserve = true which is preventing bad credentials from being erased.

15:38:45.417195 ...\Program.cs:233 trace: [Erase] preserve = true, canceling erase request.

... but then why did GCM ask for them?

@thedavidscherer Can you look in your Windows Credential Manager ( + type: "Cred" and click on the "Credential Manager" icon, the click on the "Windows Credentials" tab) for your credentials?

Can you try deleting them if you see them?

This is curious.

[roach66]

I had this same problem. It occurred after I install git and tried to push from my new laptop. I uninstalled the credential manager and just typed in my password as before in the command line and it worked.

Running Windows 10.
git version 2.12.1 64-bit
Deploying to Azure

[jroelens72]

Same problem. Entering username/pw in GCM popup makes the authentication fail.
If I click on cancel when the GCM popup shows up, then the git command line program prompts for username and password. Enter it, and authentication works.
In addition, GCM DID create the credential correctly in my windows credentials, so I don't have to enter my username/pw anymore after that.

[whoisj]

@roach66 wow, I'm very sorry. This seems to be a rather serious bug. ☹️

@jroelens72 which dialog opened? Which host were you pushing to / fetching from?

[vachirkov]

Same problem. If you run GCM from the shell, it is clear that GCM on "get" returns an empty username and password

[thedavidscherer]

@whoisj Nothing is created in WCM when I enter the user/pass into GCM. If I use the user:pass@host URL format for git the credentials DO get stored in WCM and no password is required for all further commands.

It looks like this also happens if you cancel the GCM credential dialogue and git collects credentials at the CLI and they get stored and do not need entered again.

[kevbry]

Same issue here, with bitbucket, but this time a self-hosted version. Even if the credentials are already present in windows credential store they are not used. Previously was working before upgrading a few days ago.

Edit: Just to note, the same issue exists with both git bash and git cmd.
Edit2: If I cancel the GCM and OpenSSL credential prompts and use the CLI to enter password, I'm able to pull just fine. Once the pull is complete, I can see the credentials appear in my windows credential manager and am able to proceed normally from there. Issue seems to only exist on initial pull.
Credential address appears as "git:https://domain.com" once it actually makes it into the store.

10:18:36.350179 git.c:371               trace: built-in: git 'rev-parse' '--git-dir' '--is-inside-git-dir' '--is-bare-repository' '--is-inside-work-tree' '--short' 'HEAD'
10:18:38.955546 git.c:371               trace: built-in: git 'clone' '-v' 'xxxxx'
10:18:39.002349 run-command.c:369       trace: run_command: 'git-remote-https' 'origin' 'xxxxx'
10:18:41.155287 run-command.c:369       trace: run_command: 'git credential-manager get'
10:18:41.342499 git.c:596               trace: exec: 'git-credential-manager' 'get'
10:18:41.342499 run-command.c:369       trace: run_command: 'git-credential-manager' 'get'
10:18:41.451706 ...\Program.cs:671      trace: [Main] git-credential-manager (v1.9.0) 'get'
10:18:41.482908 ...Configuration.cs:243 trace: [LoadGitConfiguration] git Portable, UserOnly config read, 20 entries.
10:18:41.498509 ...\Where.cs:231        trace: [FindGitInstallations] found 1 Git installation(s).
10:18:41.514110 ...Configuration.cs:243 trace: [LoadGitConfiguration] git All config read, 20 entries.
10:18:41.514110 ...\Program.cs:686      trace: [EnableTraceLogging] trace logging enabled.
10:18:41.514110 ...\Program.cs:702      trace: [EnableTraceLogging] git global config found at 'Y:\.gitconfig'.
10:18:41.529711 ...\Program.cs:737      trace: [EnableTraceLogging] trace log destination is 'Y:\'.
10:18:41.545312 ...\Program.cs:384      trace: [CreateAuthentication] detecting authority type for 'xxxxx'.
10:18:41.560913 ...uthentication.cs:131 trace: [GetAuthentication] not github.com, authentication creation aborted.
10:18:41.560913 ...\Program.cs:463      trace: [CreateAuthentication] authority for 'xxxxx' is basic with NTLM=Never.
10:18:41.560913 ...uthentication.cs:132 trace: [AcquireCredentials] prompting user for credentials for 'xxxxx'.
10:18:47.054465 ...\Program.cs:1284     trace: [ModalPromptDisplayDialog] successfully acquired credentials from user.
10:18:47.054465 ...\Program.cs:1001     trace: [QueryCredentials] credentials found.
10:18:47.319682 run-command.c:369       trace: run_command: 'git credential-manager erase'
10:18:47.476692 git.c:596               trace: exec: 'git-credential-manager' 'erase'
10:18:47.476692 run-command.c:369       trace: run_command: 'git-credential-manager' 'erase'
10:18:47.570298 ...\Program.cs:671      trace: [Main] git-credential-manager (v1.9.0) 'erase'
10:18:47.617101 ...Configuration.cs:243 trace: [LoadGitConfiguration] git Portable, UserOnly config read, 20 entries.
10:18:47.632702 ...\Where.cs:231        trace: [FindGitInstallations] found 1 Git installation(s).
10:18:47.648303 ...Configuration.cs:243 trace: [LoadGitConfiguration] git All config read, 20 entries.
10:18:47.648303 ...\Program.cs:686      trace: [EnableTraceLogging] trace logging enabled.
10:18:47.648303 ...\Program.cs:702      trace: [EnableTraceLogging] git global config found at 'Y:\.gitconfig'.
10:18:47.663904 ...\Program.cs:737      trace: [EnableTraceLogging] trace log destination is 'Y:\'.
10:18:47.663904 ...\Program.cs:233      trace: [Erase] preserve = true, canceling erase request.
10:18:47.695106 run-command.c:369       trace: run_command: 'git credential-manager erase'
10:18:47.804313 git.c:596               trace: exec: 'git-credential-manager' 'erase'
10:18:47.804313 run-command.c:369       trace: run_command: 'git-credential-manager' 'erase'
10:18:47.882318 ...\Program.cs:671      trace: [Main] git-credential-manager (v1.9.0) 'erase'
10:18:47.929121 ...Configuration.cs:243 trace: [LoadGitConfiguration] git Portable, UserOnly config read, 20 entries.
10:18:47.944722 ...\Where.cs:231        trace: [FindGitInstallations] found 1 Git installation(s).
10:18:47.960323 ...Configuration.cs:243 trace: [LoadGitConfiguration] git All config read, 20 entries.
10:18:47.960323 ...\Program.cs:686      trace: [EnableTraceLogging] trace logging enabled.
10:18:47.960323 ...\Program.cs:702      trace: [EnableTraceLogging] git global config found at 'Y:\.gitconfig'.
10:18:47.975924 ...\Program.cs:737      trace: [EnableTraceLogging] trace log destination is 'Y:\'.
10:18:47.975924 ...\Program.cs:233      trace: [Erase] preserve = true, canceling erase request.
10:18:48.225540 git.c:371               trace: built-in: git 'rev-parse' '--git-dir' '--is-inside-git-dir' '--is-bare-repository' '--is-inside-work-tree' '--short' 'HEAD'

[seiter]

First, _thanks much for providing a great product_, it is great to have a good solution to a common problem! Hopefully this feedback will be helpful in making it even better.

Windows 7 Professional Service Pack1
git version 2.8.3 (installed via Cygwin64 if that matters)
Git Credential Manager for Windows version 1.9.0

I'm having the same experience as @jroelens72 where if I click cancel on the dialog and enter credentials on the command line they seem to store and be used from there on out.

Since things only seemed to be working from the command line, I tried following the directions regarding modalPrompt setting git config --global credential.modalPrompt false with the hope that the GUI dialog would be skipped; no joy, it still prompts with the model.

Not a big deal, but certainly an improvement opportunity.

[whoisj]

Thanks @seiter @kevbry @thedavidscherer it seems @mminns from Atlassian has found the issue. I hope to have a fix prepared this weekend, and then a release out some time next week.

[jixuan1989]

The same issue... And before I upgrade the git-for-windows several minutes ago, I used version 2.5.0, it works for bitbuket. After I upgrade it to 2.12.0 (for enjoying the function of git-credential-manager)
Now........ I am trying to downgrade to 2.5.0....

[whoisj]

@jixuan1989 there's no reason to downgrade your version of Git for Windows. It is uncoupled from Git Credential Manager for Windows. The Git for Windows installer is kind enough to let GCM get a free ride with it, but they are not coupled.

To change the version of GCM just grab an installer from Code > Release, or to remove it completely run git config unset credential.manager.

[jixuan1989]

@whoisj I see. Thank you. By the way, I have tried and the correct command is git config --unset credential.helper :D

[zeroxia]

Maybe I have the same problem, I'm sure the username and password is correct, but it just fails to authenticate with my own repo, but it works well with github. For now I found that just manually create the credential entry in the credential manager can solve the problem.

My setup is as follows:

1. A VPS running Ubuntu Linux 16.04

2. Use git + nginx to server git repo over https, say https://myserver.com/path/to/myrepo.git

3. I have been always using git from git-scm.com for Windows, and all worked well, the local system is Windows 7

4. Now I upgraded the git to "Git-2.12.2-64-bit.exe" (I uninstalled the existing one first)

5. git clone from github https:// repo and pushing are both okay, I see there is a pop up window with "GitHub Login" prompt to let me enter username and password, after cloning, I can find a generic credential entry in Windows Credential Manager from the control panel.

6. But git clone from my own repo does not work, there is a pop up window let me enter username and password, this window is different from the GitHub repo triggered one, I think it's the standard Windows dialog for entering username and password. Anyway, after entering username/password, the cloning just failed:
   git clone https://myserver.com/path/to/myrepo.git test-clone
   Cloning into 'test-clone'...
   fatal: Authentication failed for 'https://myserver.com/path/to/myrepo.git'

7. I try to tweak with credential.helper config, no luck. But If I uninstall the git, and reinstall, without ticking the option to install the windows credential manager, I can clone my repo, but only to enter password at the command line window, rather than a pop up GUI window.

8. Finally I found that I can manually create a new credential entry in Credential Manager like the existing GitHub one, and then doing the cloning of my own repo just works.

[whoisj]

@zeroxia thanks for the report.

Firstly, I think that may be the cutest avatar on GitHub - so congratulations there and well done.

Secondly, I'm a little confused. Let me see if I understand this:

1. First you clone from GitHub (and that works) to your personal server
2. Then you clone the same content from your personal server to a local repo, but that fails because reasons unknown.

Is that right?

What authentication mechanism is your server expecting? Basic? Could you trap GIT_TRACE_CURL=1 output and see what is happening differently between success and failure attempts?

I'm a bit in the dark here. While I believe that the GCM isn't doing something correctly when it comes to your setup, I have no idea what it isn't doing (or is doing and shouldn't be). I'll need you to do some digging on your-side of things.

Btw, I think that :

Finally I found that I can manually create a new credential entry in Credential Manager like the existing GitHub one, and then doing the cloning of my own repo just works.

Is the most telling piece here. The GCM only stored Basic credentials in the Credential Manager after Git asks it to. It seems that there's some difference between what Git receives from GCM dialog than what it receives from GCM reading the cache.

[zeroxia]

@whoisj
I'm not quite a master on setting up git repo on server side, I just followed some tutorial on the web to setup the https serving with git repos on my VPS, it was long time ago and it worked well with previous git-windows so I'm not quite sure about the authentication mechanism now. I will try that GIT_TRACE_CURL stuff when I have SSH access to my VPS, also I will look at the configurations of nginx server, and provide feedback here asap.

So for the latest "Git-2.12.2-64-bit.exe" release, I can authenticate to my own github repo like a URL below:
https://github.com/zeroxia/mystery
I can push to it, so there is no problem.

But for my own repo, like https://example.com/repos/test.git (it does not have the same content as github one, but I think this doesn't matter), there is a standard Windows GUI pop up window asking for username and password, after that, the command line shows "Authentication failed". Then I go to Windows "Control Panel" --> "Credentials Manager", under "Generic Credentials" section, there is only the "git:https://github.com" entry. It seems the "Windows Credentials Manager" failed to create a new entry for my own server. So I click the "Add a generic credential" link, and enter the following info:
Internet or network address: git:https://example.com
Username:
Password:

Then I go back to the Git Bash window, repeat the last failed clone command, it just works, without asking for username/password.

[whoisj]

@zeroxia the dialog presented to you was for "basic credentials". Those credentials are passed to Git for processing. Git then calls back to the credential manager with instructions to store them or not. If Git thought they were invalid, then the GCM would not have stored them.

The GCM reads from the Credential Manager > Windows Credentials > Generic Credentials and searches for "git:". If it find a matching entry, it passes it to Git for processing. Git will then call the credential manager back with instructions to retain or erase the credentials.

It seems only one side of this contract is working. What locale is your bash shell set to? What locale is your OS set to?

[viceice]

Using wincred helper as a workaround.

git config --system credential.helper wincred

Hitting cancel on the dialog and enter credentials on console is working too. Credentials are stored correctly. See attached trace log.

Regards
Michael

Git.txt

[whoisj]

@ViceIce this is going to pedantic but how is the value stored in the Credential Manager?

I see a check for "https://git.XXX.de/" and a store for "https://git.XXX.de". The horrifying potential here is that somehow the trailing '/' is no longer being stripped correctly.

[viceice]

@whoisj It's stored without the ending slash.