GCM is not prompting for updated password

[ranadeep-sharma]

Versions installed

git version 2.17.1.windows.2 Git Credential Manager for Windows version 1.16.3

1. Executed command git config --global credential.helper wincred

2. Executed command git pull

remote: Invalid username or password. fatal: Authentication failed for 'https://github.myOrg.net/Repos/MyApp/'

3. Captured below logs.

**14:41:45.945538 exec_cmd.c:236          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
14:41:45.976750 git.c:344               trace: built-in: git config --global credential.helper wincred
14:42:26.328349 exec_cmd.c:236          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
14:42:26.486408 git.c:344               trace: built-in: git pull
14:42:26.580042 run-command.c:640       trace: run_command: git fetch --update-head-ok
14:42:26.751706 exec_cmd.c:236          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
14:42:26.829735 git.c:344               trace: built-in: git fetch --update-head-ok
14:42:26.938976 run-command.c:640       trace: run_command: git remote-https origin https://github.myOrg.net/Repos/MyApp
14:42:27.096034 exec_cmd.c:236          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
14:42:27.174063 git.c:576               trace: exec: git-remote-https origin https://github.myOrg.net/Repos/MyApp
14:42:27.174063 run-command.c:640       trace: run_command: git-remote-https origin https://github.myOrg.net/Repos/MyApp
14:42:27.376939 exec_cmd.c:236          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
14:42:27.987566 run-command.c:640       trace: run_command: 'git credential-manager get'
14:42:28.596192 exec_cmd.c:236          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
14:42:28.689827 git.c:576               trace: exec: git-credential-manager get
14:42:28.689827 run-command.c:640       trace: run_command: git-credential-manager get
14:42:28.956126 ...\Common.cs:665       trace: [Main] git-credential-manager (v1.16.3) 'get'
14:42:29.069368 ...\Git\Where.cs:343    trace: [FindGitInstallations] found 1 Git installation(s).
14:42:29.303455 ...Configuration.cs:222 trace: [LoadGitConfiguration] git All config read, 34 entries.
14:42:29.350272 ...\Common.cs:84        trace: [CreateAuthentication] detecting authority type for 'https://github.myOrg.net/'.
14:42:29.365878 ...\Common.cs:195       trace: [CreateAuthentication] authority for 'https://github.myOrg.net/' is basic with NTLM=Auto.
14:42:29.365878 ...seSecureStore.cs:195 trace: [ReadCredentials] credentials for 'git:https://github.myOrg.net' read from store.
14:42:29.365878 ...\Common.cs:699       trace: [QueryCredentials] credentials found.
14:42:30.115957 run-command.c:640       trace: run_command: 'git credential-manager erase'
14:42:30.708977 exec_cmd.c:236          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
14:42:30.802612 git.c:576               trace: exec: git-credential-manager erase
14:42:30.802612 run-command.c:640       trace: run_command: git-credential-manager erase
14:42:31.084517 ...\Common.cs:665       trace: [Main] git-credential-manager (v1.16.3) 'erase'
14:42:31.162546 ...\Git\Where.cs:343    trace: [FindGitInstallations] found 1 Git installation(s).
14:42:31.381027 ...Configuration.cs:222 trace: [LoadGitConfiguration] git All config read, 34 entries.
14:42:31.412239 ...\Common.cs:84        trace: [CreateAuthentication] detecting authority type for 'https://[email protected]/'.
14:42:31.427844 ...\Common.cs:195       trace: [CreateAuthentication] authority for 'https://[email protected]/' is basic with NTLM=Auto.
14:42:31.427844 ...\Common.cs:219       trace: [DeleteCredentials] deleting basic credentials for 'https://[email protected]/'.
14:42:31.427844 ...aseSecureStore.cs:59 trace: [Delete] credentials not found for 'git:https://[email protected]'.
14:42:31.459056 run-command.c:640       trace: run_command: 'git credential-wincred erase'
14:42:32.100895 exec_cmd.c:236          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
14:42:32.194529 git.c:576               trace: exec: git-credential-wincred erase
14:42:32.194529 run-command.c:640       trace: run_command: git-credential-wincred erase
**

[whoisj]

Looks like your service is setup with NTLM support, is broadcasting it, and thus the GCM is attempting to invoke cURL's NTLM support. Are you not expecting NTML support?

What kind of authentication scheme are you expecting?

git config --global credential.helper wincred

... and wincred is another tool. 🤷🏻‍♂️

[ranadeep-sharma]

Thanks for the prompt response.

I think NTLM is not used for accessing my corporate Github site, since I always get prompted for my Windows username/password on a designated login web page of corporate Github site in my web browser, after I login successfully into my Windows OS. Once the web session expires, I will be prompted again while re-visiting the site.

However, I am also unable to see what's currently stored in the abstracted credential storage, as seen below.

$ git credential fill

protocol=https host=github.myOrg.net <ENTER> warning: invalid credential line: ? fatal: unable to read credential from stdin

The captured git.log shows the following - 19:19:54.510359 exec_cmd.c:236 trace: resolved executable dir: C:/Program Files/Git/mingw64/bin 19:19:54.687359 git.c:344 trace: built-in: git credential fill 11:38:11.856327 exec_cmd.c:236 trace: resolved executable dir: C:/Program Files/Git/mingw64/bin 11:38:11.875327 git.c:344 trace: built-in: git config --global credential.helper wincred 11:38:25.300327 exec_cmd.c:236 trace: resolved executable dir: C:/Program Files/Git/mingw64/bin 11:38:25.479327 git.c:344 trace: built-in: git credential fill

The following are my current Git client settings, in case they give some clues.

$ git config --list core.symlinks=false core.autocrlf=true core.fscache=true color.diff=auto color.status=auto color.branch=auto color.interactive=true help.format=html rebase.autosquash=true http.sslcainfo=C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt http.sslbackend=openssl diff.astextplain.textconv=astextplain filter.lfs.clean=git-lfs clean -- %f filter.lfs.smudge=git-lfs smudge -- %f filter.lfs.process=git-lfs filter-process filter.lfs.required=true core.editor='C:\Users\myUserid\Sandbox\Installed\Notepad++\notepad++.exe' -multiInst -notabbar -nosession -noPlugin user.name=myUserid [email protected] url.https://.insteadof=git:// http.sslcainfo=C:/Program Files/Git/usr/bin/curl-ca-bundle-ghfw.crt core.repositoryformatversion=0 core.filemode=false core.bare=false core.logallrefupdates=true core.symlinks=false core.ignorecase=true remote.origin.url=https://github.myOrg.net/Repos/MyApp.git remote.origin.fetch=+refs/heads/:refs/remotes/origin/

[jahir]

This is probably a duplicate of #703: GCM retrieves credentials for https://github.myOrg.net/, git gets rejected with this data and tells GCM to erase it, but GCM now tries to delete credentials for https://[email protected]/, which does not exist.

A workaround is to put the username yourself in the remote URL (git remote set-url origin https://[email protected]/) , so that GCM stores your credentials with https://[email protected]/, but that's kind of ugly.

[michaelblyons]

A workaround is to put the username yourself in the remote URL (git remote set-url origin https://[email protected]/) , so that GCM stores your credentials with https://[email protected]/, but that's kind of ugly.

I'm not convinced it's ugly, but I do know that if the repository is on a shared computer outside of a user's folder, it's bad form to include a username in the remote. If someone wants to push, they should be asked for their credentials.

[jahir]

GCM4W seems to be more or less abandoned (last release more than a year ago, only one commit to master since then named, I kid you not, "Recreate the scalable version of the GCM Logo"). But don't despair, with Microsoft now going Core, there is a shiny new project called GCM Core,, which seems to handle password changes correctly. It can be installed standalone (should be activated automatically, otherwise activate e.g. with git config --system credential.helper manager-core) but is also included in the current Git for Windows 2.28.0. For more information about it, see this blog post.

(Copied from my SO answer about this very same issue)

[dscho]

Indeed, Git Credential Manager Core, being portable, is the designated successor of Git Credential Manager for Windows, which is not portable.