Git-credential-manager-for-windows: Can't auth to GitHub Gist

[iki]

1. Install GCM 1.12.0 with Git 2.14.2.windows.1
2. Enable 2FA on GitHub
3. Remove any stored GitHub credentials in Windows
4. Push your cloned GitHub repo => GCM asks for user/password, then for 2FA code, connects ok
5. Push your cloned Gist repo => GCM asks for user/password twice in modal window and once in console, fails to auth each time even when I pass the same credentials as in step 3

[whoisj]

/CC @shiftkey @Haacked

Can either of you guys (or maybe another Githubber) assist here? I'm completely underwater this week, thanks!

[haacked]

Judging by the behavior, my guess is that GCM doesn't recognize that gist.github.com should delegate to the GitHub authentication dialog.

@iki can you post screenshots of what dialog you get with step 3 and which one you get with step 4?

[iki]

@Haacked The dialog in step 3 was the same as in step 4: the GCM modal window with title "GitHub Login":

Btw, I just switched back to helper = winstore to be able to work with gist in meantime, and when switching to GCM temporarily to make the screenshot, I found that GCM can use the Winstore credentials for GitHub in step 3 (ie, GCM does not ask for l/p anymore and just connects), but still asks for credentials for Gist (even if they are set in Windows Credential Manager, and Winstore can use them to connect) and then it fails as before (the modal dialog now only appears once, though - no matter if you fill user/password correctly, or cancel it - before it appeared twice).

[whoisj]

@iki any chance you're attempting to enter a PAT (personal access token) as your password in the GitHub authentication dialog? We've seen past issues where a user tries to use a PAT as their password in the dialog, but because the dialog is smart (and the winstore helper isn't) it gets confused and fails to authenticate you.

[haacked]

@whoisj I don't think that's it because in the original description, @iki notes that the 2fa prompt works fine for a github.com repo, but not for a gists.github.com repo.

I found that GCM can use the Winstore credentials for GitHub in step 3 (ie, GCM does not ask for l/p anymore and just connects), but still asks for credentials for Gist (even if they are set in Windows Credential Manager, and Winstore can use them to connect) and then it fails as before (the modal dialog now only appears once, though - no matter if you fill user/password correctly, or cancel it - before it appeared twice).

@whoisj this seems to indicate that when authenticating with gist.github.com the GCM is probably asking for credentials for the gist.github.com domain but we only have credentials for github.com stored.

[haacked]

@whoisj I think this line here is the culprit: https://github.com/Microsoft/Git-Credential-Manager-for-Windows/blob/master/GitHub.Authentication/Authentication.cs#L161

We probably need to normalize the target URL if it's a gist.github.com URL. It's a special case.

[iki]

@whoisj no, I used PAT only with older git credential winstore. With GCM I use login/pass, and then I put the 2FA code into the 6-digit box. However when pushing to a gist repo, GCM doesn't auth with login/pass in the first step.

@Haacked even if there's a stored PAT for Gist in Windows Credential Manager by winstore, GCM does not use it and asks for l/p.

[iki]

@whoisj thanks for the fix! Let me know if I can retest with some build.

[whoisj]

@whoisj thanks for the fix! Let me know if I can retest with some build.

I can get a preview build out this week, but not an official build. That'll be delayed for some time unfortunately.

[turboBasic]

(Edited)

As currently latest release of Git for Windows (version 2.15.1.windows.2) comes with GCM v1.12 you should manually update GCM to v1.14 if you experience this bug

(original)

Unfortunately, Git for Windows v2.15.2 is still missing an update of GCM to v1.14 which leads to the miserable behavior

[whoisj]

Unfortunately, Git for Windows v2.15.2 is still missing an update of GCM to v1.14 which leads to the miserable behavior

This is because GCM 1.14.0 was released after Git for Windows 2.15.2, given that one, even an excellent developer like @dscho, cannot actually reach into the future this was an expected outcome. More than likely the next update to Git for Windows will include the updated GCM.

[dscho]

More than likely the next update to Git for Windows will include the updated GCM.

Indeed. If everything goes smoothly, the next Git for Windows version should be available on or around January 18th 2018.

@turboBasic In the meantime, you can also install v2.16.0-rc0 (and test it, i.e. providing valuable help, which makes a lot more sense than trying to insult Open Source maintainers), and you can always install a snapshot built from the current master branch of Git for Windows: https://wingit.blob.core.windows.net/files/index.html

[turboBasic]

@dscho I will do. The intention was to capture current state of matters and help those users who get Git Credential Manager for Windows pre-packaged with Git for Windows to manually upgrade GCM.

@dscho @whoisj It is obvious for me that I used wrong wording in my feedback, I am sorry for insulting you. You guys are awesome and you do an excellent job here in the World

[whoisj]

@dscho @whoisj It is obvious for me that I used wrong wording in my feedback, I am sorry for insulting you. You guys are awesome and you do an excellent job here in the World

No insult taken. Thank you for you apology regardless, you would not believe how often people simply refuse to apologies for their own behavior on the Internet.

I've considered adding a note the GCM FAQ that the latest version is automatically picked up by Git for Windows, but I felt that making a promise for another community was... ill-advised at best. 😏