Git is always asking for credentials for every pull/push
Asked by BertWe:

My current setup is:

Windows 11 , Git version 2.41.0.windows.1 and the git credentials are the user name and the personall access token.

Git is configured to use the Win credential store. Here is my git config:

$ git config --list  
diff.astextplain.textconv=astextplain  
http.sslbackend=schannel  
core.autocrlf=true  
core.fscache=true  
core.symlinks=false  
core.editor="C:\\\\Program Files\\\\Notepad++\\\\notepad++.exe" -multiInst -notabbar -nosession -noPlugin  
pull.rebase=false  
credential.helper=manager  
credential.<https://dev.azure.com.usehttppath=true>  
init.defaultbranch=master  
user.name=xxxx  
user.email=xxxx  
credential.helper=  
credential.helper=manager  
credential.bitbucketauthmodes=basic  
credential.<https://dev.azure.com.usehttppath=true>  
core.repositoryformatversion=0  
core.filemode=false  
core.bare=false  
core.logallrefupdates=true  
core.symlinks=false  
core.ignorecase=true

In the Win credential manager I can see an entry 'git:<https://bitbucket.org>' with my bitbucket username. After deleting that entry and doing a git pull and entering my credential it reappears in the credential manager. So it seems to be stored correctly. But is not used in subsequent git pull/push operations.

My repo url is in the following format:

remote.origin.url=https://\<user name\>@bitbucket.org/xxxxx/xxx.git

With or without 'credential.bitbucketauthmodes=basic' asking for credential is the same except the dialog for the credetials looks different.

Any ideas how to get it working?

Best regards


Answers:
author: Ben
body: G'day!

The most common issue customers are experiencing related to authentication is due to the deprecation of basic authentication (GIT username/password) in favour of App Passwords on 01/03/2022:  
<https://community.atlassian.com/t5/Bitbucket-articles/Announcement-Bitbucket-Cloud-account-password-usage-for-Git-over/ba-p/1948231>

You will need to make use of an App Password for communicating to GIT via HTTPS.  
We have documentation for usage of app passwords at the following link:  
<https://support.atlassian.com/bitbucket-cloud/docs/app-passwords/#Create-an-app-password>  
Essentially, when connecting via **HTTPS** you will use your **AppPassword** alongside your username separated with a ":" character.

Therefore if you are authenticating to **GIT over HTTPS** to push/pull you will need to update your remote URL's to include the **App Password**:

```
git remote set-url origin https://USERNAME:APP_PASSWORD@bitbucket.org/workspaceID/reposlug.git

```

The same applies when performing git clone:

```
git clone https://USERNAME:APP_PASSWORD@bitbucket.org/workspaceID/reposlug.git
```

I would suggest ensuring also that all stored passwords related to authentication over GIT are cleared from your machine (ie Credential Manager for Windows).

Hope this helps.

Cheers!

- Ben (Bitbucket Cloud Support)

comments: author: BertWe
body: Hi Ben,

I forgot to mention it in my original post, of course I'm using a username / app password combination as git https credentials. As far as I know git authentication with the email / login password is not working.

But your second advice scars me a little bit, you are really suggesting to have the app password in plain text as part of the repo (in the origin url)???

Even in the second link you are provided its suggested not to store the app password in the repo url.  

Whis an older git version it was working but here the git credential helper was 'wincred'.

Best regards


author: Ben
body: Hi Bert,

If you would not be comfortable storing the App Password in plaintext, that is completely understandable. In saying this, using **credential.helper** in your config also stores your password in a plain text file locally unless caching timeouts are used.

If you are wanting to use this feature, I'd suggest ensuring that the cached address reflects your username (if it doesn't already) - this is generally preferred over storing the username separately as this will match your remote URL:

```
git:http://username@bitbucket.org
```

To be honest, I am not entirely experienced in Windows troubleshooting when it comes to GIT - I found an article below that may be helpful in terms of explaining how to use the credential helper:

* <https://techexpertise.medium.com/storing-git-credentials-with-git-credential-helper-33d22a6b5ce7>

Thanks,

Ben


author: BertWe
body: Hi Ben,

how secure the credentials are stored depends on the type used in credential.helper.  
For example using 'store' as credential.helper will store the password as plain text.

Type 'manager' as I'm using will use a platform dependent secure store, e.g. under Windows it will use the Windoes credential manager. In my case I can see the the credentials appering in the credential manager after entering the app password when prompted. But its not used for the next git remote operation, so it asks me again.

BR


author: pbobkov
body: Hi [@BertWe](/t5/user/viewprofilepage/user-id/441052)

did you manage to move forward with the issue? I experience the same thing starting today.

Thanks,

Pavel


author: Ben
body: Are any issues encountered while using SSH? Also, if you disable credential manager by editing git config - is the connection still successful?

<https://stackoverflow.com/questions/37182847/how-do-i-disable-git-credential-manager-for-windows>

At this stage, we're trying to figure out if it's an issue with the git config or the credential manager in general.

Cheers!

- Ben (Bitbucket Cloud Support)


author: BertWe
body: Hi Ben,

I'm not using SSH, my reop url is using https and in the url included id the user name. For details see my first post.

Now I did a test with a disabled git credential manager. I removed all credential manager entris in the system, global and local gitconfig files. git config --list shows an empty credential helper:

pull.rebase=false  
credential.helper=  
credential.<https://dev.azure.com.usehttppath=true>  
init.defaultbranch=master  
user.name=\<user\>  
user.email=\<user\>  
credential.helper=  
credential.<https://dev.azure.com.usehttppath=true>  
core.repositoryformatversion=0

Now git behaves as expected, for every pull/push/fetch request it asks for the password.

But this annoing task to enter the long (non memorable) app password \~40 times per day is really breaking the work flow. Thats why I always used the credential manager.

The difference to the working (for years) solution was the upgrade to Win11 (from Win10) and the installation of the latest git version.

BR


author: Ben
body: Hi Bert,

To clarify, I am aware that you are not using SSH - this is clear in your post, it was merely a suggestion to use for testing purposes.

Based on the testing here with HTTPS, the issue is Windows-related rather than a GIT/configuration/Bitbucket issue.

Therefore, I, unfortunately, do not have any further suggestions for you as this falls outside of our scope from a support perspective. I would suggest awaiting further answers from our community or consulting with Microsoft support forums.

Thanks,

Ben


author: BertWe
body: Wrong place

comments: author: manan_arora
body: Hey, Bert may i get to know do you get the solution of this problem?


author: BertWe
body: Hi Manan,  
the problem was in the access rights for the generated app password. As I try normaly to use the very minimum rights for security reasons. So I did not assign read email access.

Then I recreated the app password with read access for user name and email and it worked.

Bert


Tags: bitbucket-cloud

cloud

git