Cannot clone git from Azure DevOps using PAT

Question

I cannot clone a simple repository from Azure DevOps. OS: Ubuntu 18.10

I do this:

• Got to Azure DevOps
• Click on the top right corner on my user name
• Go to the security tab
• Create a PAT with all the scope (to be sure there is no scope problem)
• Copy the PAT to the clipboard
• Paste the PAT somewhere else to confirm the PAT has been copied correctly (I know... not safe but that is out of the scope of this question)
• Go to my console
• Issue: git clone https://myorganization.visualstudio.com/myproject/_git/myrepo/
• I enter the user name and the password (the PAT)

I keep getting this message from Git: fatal: Authentication failed for 'https://myorganization.visualstudio.com/myproject/_git/myrepo/'

I was reading the solutions of other people but none worked for me. I also tried this:

• Pass the token in the form https://usename:[email protected]/myproject/_git/myrepo/ I am really surprised people say this worked... for my git complains because believes the : means the port.
• Tried to activate/deactivate credential manager of git * Tried on Windows and Ubuntu.
• Tried to activate and deactivate the simple credentials.
• Tried with the simple credentials, i.e. username + password.
• Tried to put my user name in https://username@....
• Tried to use SSH
• Tried to use the http.extraHeader in the git command with the header being

  Authorization: Basic Base64Encoded(uname:PAT)

• Tried to use the http.extraHeader in the git command with the header being

  Authorization: Bearer PAT

• Tried to use the VSCode client. It generates the PAT by itself but still cannot authenticate and clone.
• Tried to use the Rider VSTS client. It generates the PAT by itself but still cannot authenticate and clone.
• Tried to use the git credentials manager for Linux. It promps the Code and when we authenticate in the browser, it generates a PAT successfully. Still, after that cannot authenticate.

Any clue why this is not working?

Answer 1

I have had success using PAT like this;

1. Copy clone URL for your repository e.g.
   git clone https://<domain>.visualstudio.com/<domain>/_git/<repository>
2. After you have copied your PAT use as:
   git clone https://<PAT>@<domain>.visualstudio.com/<domain>/_git/<repository>

No Username nor password should be required as the PAT should suffice.

Answer 2

I've experienced the same issue, and spent quite a while searching for a solution. I finally came across this post which contained a solution in the comments section by Martinius79.

In short, it was required to pass the username and PAT, encoded as base64, through git http.extraheaders in order for it to authenticate.

100% Credit to the original author, just including it here to assist others in locating it:

Example: git -c http.extraheader="AUTHORIZATION: Basic TXlHaXRTeW5jVXNlcjo2bHFqNXJkcHEzdXBxZWVmd2o3bDduZXN5NTR3d3gxNHFobDVlanl5NTVkb2g0M3d4YzRh" clone https://tfs.address/tfs/Collection/Project/_git/RepoName

Used basic token BASE64 encoded: TXlHaXRTeW5jVXNlcjo2bHFqNXJkcHEzdXBxZWVmd2o3bDduZXN5NTR3d3gxNHFobDVlanl5NTVkb2g0M3d4YzRh

Basic Token BASE64 decoded: MyGitSyncUser:6lqj5rdpq3upqeefwj7l7nesy54wwx14qhl5ejyy55doh43wxc4a

Token is constructed from : In this example: Fictional user name: MyGitSyncUser Used PAT: 6lqj5rdpq3upqeefwj7l7nesy54wwx14qhl5ejyy55doh43wxc4a

I hope this helps!

Answer 3

This official guide procedure worked for me, but with one important point. When base64-encoding, one must put attention to non-printable characters.

The guide says:

MY_PAT=yourPAT      # replace "yourPAT" with your actual PAT
B64_PAT=$(printf ":$MY_PAT" | base64)
git -c http.extraHeader="Authorization: Basic ${B64_PAT}" clone 
https://dev.azure.com/yourOrgName/yourProjectName/_git/yourRepoName

Using "echo" instead of "printf" would insert a newline char, changing the base64 string (probably would work also with "echo -n" but I haven't tried). Also, do not include the username, as per the snippet above.

Used git 2.17.1 on Ubuntu 18.04.

Answer 4

I was having the same problem and got it solved using HTTPS only.

I figured out that I had to use the terminal only rather than using any "GUI shortcuts" dev.azure provides since they are meant for a git-credential-manager which works fine on windows but is broken for Ubuntu.

Apparently, the dev.azure git repository has a different credentials (which you need to set up) rather than your Microsoft account credential.

Let's say my Microsoft account username is [email protected], with its password Jd1986

This credential will NOT work if you try for git cloning, as you need to generate git credential for your project and then use it.

You can generate git credential from here,

After this, Save it and use the set credential.

Go to your terminal, and use the HTTP url for git clone and enter the given credential. This worked for me.

Answer 5

Git http.extraheader & bearer

YAML style Pipelines can use the preset variable System.AccessToken. After examining the formal 'Checkout ...' step at the beginning of the Pipeline I found this step to work in my script:

- task: PowerShell@2
  inputs:
    targetType: 'inline'
    script: 'git -c http.extraheader="AUTHORIZATION: bearer $(System.AccessToken)" clone --depth 1 https://[email protected]/my-org/my-proj/_git/my-repo'

Note that Azure DevOps job authorization scope may affect this

Answer 6

This is a known regression in curl 7.61.0, which ships with Ubuntu 18.10. The regression was fixed in curl 7.61.1, but Ubuntu 18.10 doesn't have this fix yet. See (and upvote) https://bugs.launchpad.net/ubuntu/+source/curl/+bug/1805203

Answer 7

1. Login into Azure Dev Ops portal.
2. Go to Project you wish to clone.
3. Select Repo from left menu.
4. Click on Clone from right top corner.
5. Click Generate Git Credential
6. Enter given https clone url, username & password where you are cloning repository.
7. you are done!

Answer 8

Ensure you are a member of the Contributor group and that your permissions are not limited for your user or group on the azure repo.

Azure Contributor group has per default permission to clone, fetch, and explore the contents of a repository; also, can create, comment on, vote, and contribute to pull requests.

Any of this permissions can be edited by members of the Project Administrator Group or those having Manage permissions set to Allow for Git repositories as described here.

If your group or user does not have the permission to clone the repository, you will get the behaviour described by the question.

Answer 9

Try : First delete the git credentials from Credential manager. Try Generating a new personal access token to resolve this error

Go to security ->Personal access token->Add Give Description, select All scopes, click Create Token.

Copy the token and store it for later use. This token can now be used in place of password for the git user.