{"thread":{"id":"42020","subject":"credentials are being erased from credential manager via git credential-wincred erase command","startedAt":"2016-04-13T18:49:55Z","lastAt":"2016-04-13T22:00:54Z","messageCount":3,"participants":["O'Connell, Ken","Bryan Turner","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"283400","messageId":"58eced84663c4ef38a63811d3367acf2@USNAEXCP1.pc.cognex.com","threadId":"42020","inReplyTo":null,"subject":"credentials are being erased from credential manager via git credential-wincred erase command","fromName":"O'Connell, Ken","fromEmail":"ken.o'connell@cognex.com","sentAt":"2016-04-13T18:49:55Z","receivedAt":"2016-04-13T18:49:55Z","isPatch":false,"sender":{"key":"ken.o'connell@cognex.com","avatar":null},"body":"Good afternoon,\n\nMy company setup wincred for management of our git/stash user credentials for our automated build scripts. It works great for days, sometimes a couple weeks. \nThen one day build haven't run and we discover the scripts are randomly found at a user prompt awaiting stash user credentials. \n\nWe look at Windows Credential Manager store in Windows and find the Stash user credentials are erased from Credential Manager! \n\nWe discovered via GIT_TRACE, that the command used to retrieve the credentials, is being followed up by a git command to erase the credentials. -not all the time, but seemingly in a random way.\nLooking at the trace logs on one server, we see the following commands:\n'git-remote-https' 'origin' https://stash-server/bla/bla/bla.git\n'git-credential-wincred' 'get'\n'git credential-wincred erase'\n\nDo you have ideas on how to track down the root cause of why this command is running?  \n\nInfo:\nWindows 7 machines\nGit version 1.9.5-msysgit, and Git 2.7.4 windows (on one machine to see if upgrading helped) -it did not.\nStash version 3.11.2\n\nPlease let me know if I can get any more information to help diagnose.\nThanks,\n-Ken\n"},{"id":"283402","messageId":"CAGyf7-FJcJyP_CdRZLO7Eh6DoWp8XRU2CNczCdaYJO_MS6rnmw@mail.gmail.com","threadId":"42020","inReplyTo":"58eced84663c4ef38a63811d3367acf2@USNAEXCP1.pc.cognex.com","subject":"Re: credentials are being erased from credential manager via git credential-wincred erase command","fromName":"Bryan Turner","fromEmail":"bturner@atlassian.com","sentAt":"2016-04-13T19:12:06Z","receivedAt":"2016-04-13T19:12:06Z","isPatch":false,"sender":{"key":"bturner@atlassian.com","avatar":"https://gravatar.com/avatar/16bcf3167981c1ef7c804e502642366d888a35b0d0b0a4ca01fdc442aa1acb1e?d=mp&s=160"},"body":"Ken,\n\nI'm one of the developers for Atlassian Bitbucket Server (formerly\nStash), which I believe you're running.\n\n>From the credentials code in Git (which I could be mis-reading; I'm\nsure others on the list will correct me if I'm wrong), it appears the\nerase is done after a cached credential is rejected by the server.\nThat implies that, periodically, authentication with your Stash server\nis failing and that that failed authentication results in Git clearing\nthe \"bad\" credential. That's likely why you see this happen on\nseemingly random builds.\n\nTo follow up on the possibility that authentication with Stash is\nperiodically failing, I'd recommend opening a support request at\nsupport.atlassian.com. My belief is that the remote Git client is\ndoing what it's intended to do in response to an authentication\nfailure. That suggests we need to look at your Stash instance to\ndetermine why authentication is failing. If you do open a support\nrequest, please mention me in your description so that our support\nengineers can attach me to the issue!\n\nBest regards,\nBryan Turner\n\nOn Wed, Apr 13, 2016 at 12:49 PM, O'Connell, Ken\n<Ken.O'Connell@cognex.com> wrote:\n> Good afternoon,\n>\n> My company setup wincred for management of our git/stash user credentials for our automated build scripts. It works great for days, sometimes a couple weeks.\n> Then one day build haven't run and we discover the scripts are randomly found at a user prompt awaiting stash user credentials.\n>\n> We look at Windows Credential Manager store in Windows and find the Stash user credentials are erased from Credential Manager!\n>\n> We discovered via GIT_TRACE, that the command used to retrieve the credentials, is being followed up by a git command to erase the credentials. -not all the time, but seemingly in a random way.\n> Looking at the trace logs on one server, we see the following commands:\n> 'git-remote-https' 'origin' https://stash-server/bla/bla/bla.git\n> 'git-credential-wincred' 'get'\n> 'git credential-wincred erase'\n>\n> Do you have ideas on how to track down the root cause of why this command is running?\n>\n> Info:\n> Windows 7 machines\n> Git version 1.9.5-msysgit, and Git 2.7.4 windows (on one machine to see if upgrading helped) -it did not.\n> Stash version 3.11.2\n>\n> Please let me know if I can get any more information to help diagnose.\n> Thanks,\n> -Ken\n>\n>\n>\n> --\n> To unsubscribe from this list: send the line \"unsubscribe git\" in\n> the body of a message to majordomo@vger.kernel.org\n> More majordomo info at  http://vger.kernel.org/majordomo-info.html\n"},{"id":"283419","messageId":"20160413220054.GB8712@sigill.intra.peff.net","threadId":"42020","inReplyTo":"CAGyf7-FJcJyP_CdRZLO7Eh6DoWp8XRU2CNczCdaYJO_MS6rnmw@mail.gmail.com","subject":"Re: credentials are being erased from credential manager via git credential-wincred erase command","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2016-04-13T22:00:54Z","receivedAt":"2016-04-13T22:00:54Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Apr 13, 2016 at 01:12:06PM -0600, Bryan Turner wrote:\n\n> From the credentials code in Git (which I could be mis-reading; I'm\n> sure others on the list will correct me if I'm wrong), it appears the\n> erase is done after a cached credential is rejected by the server.\n> That implies that, periodically, authentication with your Stash server\n> is failing and that that failed authentication results in Git clearing\n> the \"bad\" credential. That's likely why you see this happen on\n> seemingly random builds.\n\nYes, that's right. For HTTP, Git will erase the credential only for an\nHTTP 401 (or a 407 for the proxy credential). So an intermittent failure\nshouldn't cause us to erase the credential there.\n\nBut it's possible that a server whose credentials are backed by\nsomething more complicated than a password file (e.g., LDAP or\nsomething) may return a 401 intermittently when the backend process\nfails (e.g., connection to the LDAP server fails). And I agree with your\nsecond paragraph (that I snipped) that finding the intermittent failure\nis the best first step.\n\nWe could potentially teach Git _not_ to erase credentials in such a case\n(with a config option). But the downside would be that the user would\nthen have to manually erase and re-populate the credentials if they do\nchange.\n\nIMHO, that responsibility really lies with the credential helpers\nthemselves. Helpers like git-credential-wincred are meant to\ntransparently cache and update credentials. I think for an automated\nprocess like this, what the user really wants is more like \"I'll stick\nsome credentials in a secure place, and I want Git _only_ to access\nthem, never update them\".\n\nYou can hack together something like that today with:\n\n  git config credential.helper '!f() {\n    case \"$1\" in\n      get|store) git credential-wincred \"$@\" ;;\n    esac\n  }; f'\n\nand then you can populate it with:\n\n  echo url=https://example.com |\n  git credential fill |\n  git credential approve\n\nThe \"fill\" will prompt you and generate the proper response to feed to\n\"approve\", which will actually store it in your helper of choice. Or you\ncan just do a \"fetch\" from the repository in question, and it will\nhappen automatically.\n\nIf this pattern is something a lot of people want to use, I think we\ncould wrap that shell snippet into a \"git credential-static\" or\nsomething that chained to another helper, and you'd configure it like:\n\n  git config credential.helper 'static wincred'\n\nor something.\n\n-Peff\n"}]}