Git-credential-manager-for-windows: GCM Authentication with Bitbucket No Longer Works

[dcjulian29]

I recently upgrade to Git 2.13.1 and Git Credential-Manager for Windows 1.10.0 and then noticed that I can no longer interact with the Bitbucket origin repo without having to provide my password every time...

I even deleted the local repo and attempted to clone the origin repo but was unable to complete the operation. I did notice that my username is included in the URL and the error message mentions UriFormatExeception (https://gist.github.com/dcjulian29/0c47cc27d6e78c0c6dbec62547f49fda)...

So I attempted to remove the username from the URL and this time GCM prompted me for credentials. I entered my credentials and pressed Login. After this, I get the same prompt for authentication from Git(https://gist.github.com/dcjulian29/69d8446912d2c14c7c91c1a0fbd33a05)

I searched the issue and see a similar issue Jan 2016 but it says the bug was fix so I'm not sure if they are related...

I've turn logging in credential.writelog=true but nothing is being written to log.

[whoisj]

@mminns @Foda can one of you please help? There seems to be an issue with the BitbucketAuthorty.

@dcjulian29 please set GIT_TRACE=%userprofile%\git.log and GCM_TRACE=%GIT_TRACE% environment variables. Then rerun your command, open %userprofile%\git.log, and share the output here. Thanks!

[nvivo]

I'm still having this issue as reported here.

I reverted back to 1.9.1, it kept asking for the password every time. I came to this window:

and set it to None, saved and set it back to manager, and it worked again.

I decided to give it another try today, re-upgraded to 1.10 and had the same problem. Resetting to manager didn't work this time, so I'm back to 1.9.1 until this is solved.

[nvivo]

BTW, here is my git.log with 1.10:

https://gist.github.com/nvivo/5a6eb3750d153fe591a67858a847859b

[whoisj]

@nvivo thanks for the git.log file, unfortunately it doesn't contain any log data from the GCM. :sad:

@mminns @foda looks like another user having issues with the GCM and BitBucket.

[nvivo]

@whoisj I have set both variables as requested:

C:\Users\nvivo>set | grep GIT
GCM_TRACE=%GIT_TRACE%
GIT_TRACE=C:\Users\nvivo\git.log

Is there anything else? Maybe I need to restart tortoisegit to get these variables... will restart and try again

[whoisj]

Looks like the GCM_TRACE=%GIT_TRACE% is not expanding as expecting, try changing it to GCM_TRACE=C:\Users\nvivo\git.log.

[nvivo]

Duh! =) Now we're talking... looks like an error parsing the url. Here is the correct log:

https://gist.github.com/nvivo/62513e80f2b221a7bcfca02915ea4804

[whoisj]

@mminns @foda this looks like the exact same error reported in the other issues. Please investigate. 📟

10:35:10.756830 ...\Program.cs:807      trace: [CreateAuthentication] authority for 'https://bitbucket.org/'  is Bitbucket
10:35:10.770835 ...seSecureStore.cs:134 trace: [ReadCredentials] credentials for 'git:https://bitbucket.org' read from store.
10:35:10.771833 ...uthentication.cs:163 trace: [GetCredentials] successfully retrieved stored credentials, updating credential cache
10:35:10.777837 ...\Program.cs:62       trace: [_dieExceptionCallback] System.UriFormatException: actualUrl
   at Microsoft.Alm.Authentication.TargetUri..ctor(String actualUrl, String queryUrl, String proxyUrl)
   at Atlassian.Bitbucket.Authentication.Authentication.GetPerUserTargetUri(TargetUri targetUri, String username)
   at Atlassian.Bitbucket.Authentication.Authentication.<ValidateCredentials>d__33.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Alm.Cli.Program.<>c__DisplayClass84_5.<<QueryCredentials>b__5>d.MoveNext()

@nvivo thanks for you diligence - with luck we'll have a fix in the near future. I am assuming that our Atlassian partners (@mminns or @foda) will be able to resolve this. If not, I'll take a crack at it as soon as my (Microsoft) Visual Studio 2017 workload lightens up. Thanks for you patience. 😄

[Foda]

Thanks for the feedback and logs. We''ll take a look this week!

[mminns]

Hi, been off for a few days, will investigate.

[dcjulian29]

I can confirm that I get the same exception as well...

14:49:28.046608 ...\Program.cs:807      trace: [CreateAuthentication] authority for 'https://bitbucket.org/'  is Bitbucket
14:49:28.061116 ...\Program.cs:62       trace: [_dieExceptionCallback] System.UriFormatException: actualUrl
   at Microsoft.Alm.Authentication.TargetUri..ctor(String actualUrl, String queryUrl, String proxyUrl)
   at Atlassian.Bitbucket.Authentication.Authentication.GetPerUserTargetUri(TargetUri targetUri, String username)
   at Atlassian.Bitbucket.Authentication.Authentication.<InteractiveLogon>d__29.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Alm.Cli.Program.<>c__DisplayClass84_5.<<QueryCredentials>b__5>d.MoveNext()
14:49:28.062112 ...\Program.cs:358      trace: [LogEvent] System.UriFormatException: actualUrl
   at Microsoft.Alm.Authentication.TargetUri..ctor(String actualUrl, String queryUrl, String proxyUrl)
   at Atlassian.Bitbucket.Authentication.Authentication.GetPerUserTargetUri(TargetUri targetUri, String username)
   at Atlassian.Bitbucket.Authentication.Authentication.<InteractiveLogon>d__29.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Alm.Cli.Program.<>c__DisplayClass84_5.<<QueryCredentials>b__5>d.MoveNext()
14:49:28.064113 ...\Program.cs:80       trace: [_dieMessageCallback] fatal: UriFormatException encountered.
   actualUrl
14:49:28.089114 run-command.c:369       trace: run_command: 'git credential-manager get'

[mminns]

Looks like the problem is in here

    /// <summary>
    /// Since Bitbucket requires a username in a Git remote URL even if using OAuth tokens
    /// </summary>
    /// <param name="targetUri"></param>
    /// <param name="username"></param>
    /// <returns></returns>
    private TargetUri GetPerUserTargetUri(TargetUri targetUri, string username)
    {
        if (string.IsNullOrWhiteSpace(username))
        {
            return targetUri;
        }

        return new TargetUri(targetUri.ActualUri.AbsoluteUri.Replace(targetUri.Host, username + "@" + targetUri.Host));
    }

Its not checking if the targetUri already contains a username before trying to prepend it.
Not sure how that got through earlier testing but there is a potentially easy fix as follows

    /// <summary>
    /// Since Bitbucket requires a username in a Git remote URL even if using OAuth tokens
    /// </summary>
    /// <param name="targetUri"></param>
    /// <param name="username"></param>
    /// <returns></returns>
    private TargetUri GetPerUserTargetUri(TargetUri targetUri, string username)
    {
        if (string.IsNullOrWhiteSpace(username) || TargetUriContainsUsername(targetUri))
        {
            return targetUri;
        }

        return new TargetUri(targetUri.ActualUri.AbsoluteUri.Replace(targetUri.Host, username + "@" + targetUri.Host));
    }

Just working on testing it now.

[mminns]

So that issue I mention above is definitely a thing, but it doesn't seem to be playing nicely with this change either https://github.com/Microsoft/Git-Credential-Manager-for-Windows/commit/fbcbb9227d35edb7ee3a40d842d58b813cefdb44#diff-84bb57fa7b53195070c7e2a0a16d1e35
As it seems to be no longer saving credentials per user, but I haven't worked out exactly when that problem started.

I will look further

[whoisj]

@mminns thanks - are there tests you're writing to validate this that I can use to help track the issue down and/or provide a resolution by?

[mminns]

Still working out what has changed at the moment and how to test and fix. Will let you know more as soon as I can

[mminns]

OK I think I now understand...
The crash, which is due to the BbC code trying to add the username to a URL that already contains a username@ part, has appeared due to the change to the format of the actualUrl in the TargetUri class in this commit
https://github.com/Microsoft/Git-Credential-Manager-for-Windows/commit/fbcbb9227d35edb7ee3a40d842d58b813cefdb44#diff-84bb57fa7b53195070c7e2a0a16d1e35
Previously there was no username in the actualUrl so the BbC got away with simply adding it. That should be the easy fix outlined above.

Tricker is the change to the TargetUri.ToString() method, previously it was just the TargetUri.QueryUrl which in BbC's case was simply the TargetUrl.ActualUrl which meant it would contain the username and allow the bbC code to save credentials per username.

in https://github.com/Microsoft/Git-Credential-Manager-for-Windows/commit/fbcbb9227d35edb7ee3a40d842d58b813cefdb44#diff-84bb57fa7b53195070c7e2a0a16d1e35 the ToString() changed and for the BbC case it now returns the Url without the username

AFAICS the way to fix that would be to have BbC code generate its own SecretStore and provide a different _getTargetName method, one that used the TargetUri.ToString(true) method to ensure the username, if it existed was used.

Not I've not tested that yet .... :)

ps. Sorry there weren't tests to catch this, I was obviously too shy about changing the visibility of methods to allow them to be tested.... wont make that mistake again :)

[whoisj]

@mminns seems to be that it would be a lot simpler if BbC just supplied its own Secret.UriNameConversion callback when allocating the SecretStore. No?

[mminns]

Yes that's the plan.