git-ecosystem / git-ecosystem/git-credential-manager

GCM not Persisting new Bitbucket Cloud API Tokens (for git basic auth)

Open
#1,991 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

auth-issue host:bitbucket
Dominant language
C#
Stars
9.3k
Forks
2.9k
Avg merge
7d 1h
Merged PRs (30d)
14

Description

Version

2.6.1+786ab03440ddc82e807a97c0e540f5247e44cec6

Operating system

Windows

OS version or distribution

Windows Server 2016

Git hosting provider(s)

Bitbucket Cloud

Other hosting provider

No response

(Azure DevOps only) What format is your remote URL?

None

Can you access the remote repository directly in the browser?

Yes, I can access the repository

Expected behavior

Bitbucket Cloud is swapping from using app passwords to Atlassian (Bitbucket-scoped) API tokens for git basic auth. I am expecting that when I provide to GCM my BitbucketUsername + new API token and this first authentication is successful, that GCM will save and reuse this credential for subsequent git commands.

Actual behavior

When I am initially prompted by GCM to provide my credentials, I am able to do so and the git command authenticates + executes successfully. However, if I immediately run another git command, it asks for my credentials again. This initial authentication via GCM does create an entry in Windows Credential Manager that has the correct username/URL. My new API token does have all 37 scopes enabled.

It is worth noting that if I try this exact same flow using the exact same account + server and instead provide a (soon to be deprecated) App Password, I am not prompted for credentials on subsequent git commands.

Is it possible that this is related to the increased character size of the new API tokens? The App Passwords had a length of 36, while the new API tokens are 192 characters.

Any insight would be appreciated - thanks!

Logs

Part of first logs where credentials were provided, authenticated correctly, and saved:
15:36:21.870762 ...viderRegistry.cs:162 trace: [GetProviderAsync] Auto-detect probe timeout is 2 ms.
15:36:21.873762 ...viderRegistry.cs:170 trace: [GetProviderAsync] Checking against 4 host providers registered with priority 'Normal'.
15:36:21.875763 ...GitCommandBase.cs:49 trace: [ExecuteAsync] Host provider 'Bitbucket' was selected.
15:36:21.876768 ...tHostProvider.cs:335 trace: [StoreCredentialAsync] Storing credential...
15:36:21.883763 ...tHostProvider.cs:337 trace: [StoreCredentialAsync] Credential was successfully stored.
15:36:21.883763 ...GitCommandBase.cs:53 trace: [ExecuteAsync] End 'store' command...
15:36:22.072766 run-command.c:674 trace: run_command: git rev-list --objects --stdin --not --exclude-hidden=fetch --all --quiet --alternate-refs
15:36:22.073761 run-command.c:935 trace: start_command: git rev-list --objects --stdin --not --exclude-hidden=fetch --all --quiet --alternate-refs

Second command where credentials don't seem to work and re-prompts for credentials:
15:36:29.771819 exec-cmd.c:266 trace: resolved executable dir: D:/Application/Git/mingw64/libexec/git-core
15:36:29.779816 git.c:476 trace: built-in: git config --null --type=path http.https://bitbucket.org.cookieFile
15:36:29.844823 exec-cmd.c:266 trace: resolved executable dir: D:/Application/Git/mingw64/libexec/git-core
15:36:29.850811 git.c:476 trace: built-in: git config --null --type=path http.bitbucket.org.cookieFile
15:36:29.911816 exec-cmd.c:266 trace: resolved executable dir: D:/Application/Git/mingw64/libexec/git-core
15:36:29.916815 git.c:476 trace: built-in: git config --null --type=path http.cookieFile
15:36:30.137815 ...tbucketRestApi.cs:40 trace: [GetUserInformationAsync] HTTP: Response 401 [Unauthorized]
15:36:30.139813 ...tHostProvider.cs:426 trace: [ValidateCredentialsWork] Failed to validate existing credentials using OAuth
15:36:30.140814 ...tHostProvider.cs:427 trace: [ValidateCredentialsWork] ! error: 'Failed to resolve username. HTTP: Unauthorized'.
15:36:30.143820 ...tbucketRestApi.cs:37 trace: [GetUserInformationAsync] HTTP: GET https://api.bitbucket.org/2.0/user
15:36:30.217822 ...tbucketRestApi.cs:40 trace: [GetUserInformationAsync] HTTP: Response 401 [Unauthorized]
15:36:30.218815 ...tHostProvider.cs:443 trace: [ValidateCredentialsWork] Failed to validate existing credentials using Basic Auth
15:36:30.220823 ...tHostProvider.cs:444 trace: [ValidateCredentialsWork] ! error: 'Failed to resolve username. HTTP: Unauthorized'.
15:36:30.223817 ...tHostProvider.cs:135 trace: [GetRefreshedCredentials] Refresh credentials...
15:36:30.224819 ...tHostProvider.cs:141 trace: [GetRefreshedCredentials] Checking for refresh token...
15:36:30.225814 ...tHostProvider.cs:148 trace: [GetRefreshedCredentials] No stored refresh token found
15:36:30.226813 ...tHostProvider.cs:152 trace: [GetRefreshedCredentials] Prompt for credentials...

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with BitbucketHostProvider.cs and BitbucketRestApi.cs, following the credential validation and storage flow shown in the logs. Reproduce the Windows flow with a Bitbucket API token, compare it with an app password, and verify that a successful first authentication is reused without prompting on the next Git command.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, git
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.