Cloning Git Repo using TFS Personal Access Token

Question

I am trying to programmatically clone a git repository. My ASP.NET MVC application is creating and starting a process. The code to handle the processes works correctly however the authentication is failing when trying to use a TFS on premise PAT to clone a git repository. I cannot use NTLM or require the user to enter credentials. I can confirm my C# code handling creating processes to use the git bash shell programmatically works as I have no issue on my local machine but in production on IIS the issue arises. I have tried the following two methods.

Method 1: git clone http://anyusername:PAT@tfs2017:8080/tfs/DefaultCollection/_git/Git%20Repository

PAT is the token I have generated for my user. I have tried to encode it in base64 as well.

Method 2: As suggested by a person on a MS social forum.

git -c http.extraheader="AUTHORIZATION:bearer {base64encodedPAT}" clone {url}

Original MS Forum Question for Reference: https://social.msdn.microsoft.com/Forums/vstudio/en-US/0107cf1f-7fe4-4429-af74-ca7d2be7405e/using-personal-access-tokens-in-tfs-2017?forum=tfsversioncontrol

Answer 1

If you have a PAT, you should not need a password: the PAT would act as your username.
See if the following works:

git clone http://PAT@tfs2017:8080/tfs/DefaultCollection/_git/Git%20Repository

Answer 2

You can use the CredentialManager by programmatically adding the token to the machine, the same way CredentialManager would do it.
On Windows I use the cmdkey tools as follow:

cmdkey /generic:"git:https://yourdomain.visualstudio.com" /user:"Personal Access Token" /pass:"yourtokenhere"

On MacOS add an entry in the keychain:

security add-generic-password -a "Personal Access Token" -D "Credential" -s "gcm4ml:git:https://yourdomain.visualstudio.com" -w "yourtokenhere" -A

Note: Avoid using -A which allows any application to access it.

As long as the CredentialManager is installed on Git, it should work.

Answer 3

I was a bit confused after reading the article from MS. After trying out some ways, I was finally able to use my PAT against TFS and VSTS GIT Repos.

The only way I was able to get a clone of my GIT repo using a PAT was setting the http.extraheader in the GIT commandline.
The authorization tag must point to basic authentication, the protocol must be HTTPS, and the token must be BASE64 encoded, including a (fictional) user name.

Example:

git -c http.extraheader="AUTHORIZATION: Basic TXlHaXRTeW5jVXNlcjo2bHFqNXJkcHEzdXBxZWVmd2o3bDduZXN5NTR3d3gxNHFobDVlanl5NTVkb2g0M3d4YzRh" clone https://tfs.address/tfs/Collection/Project/_git/RepoName

Used basic token BASE64 encoded:

TXlHaXRTeW5jVXNlcjo2bHFqNXJkcHEzdXBxZWVmd2o3bDduZXN5NTR3d3gxNHFobDVlanl5NTVkb2g0M3d4YzRh

Basic Token BASE64 decoded:

MyGitSyncUser:6lqj5rdpq3upqeefwj7l7nesy54wwx14qhl5ejyy55doh43wxc4a

Token is constructed from <fictional user name>:<PAT from a user with rights in the project>

In this example:

Fictional user name: MyGitSyncUser Used PAT: 6lqj5rdpq3upqeefwj7l7nesy54wwx14qhl5ejyy55doh43wxc4a

PAT scope: Code (Read)

The TFS/VSTS doesn't accept "AUTHORIZATION: Bearer" headers at the moment :(

Maybe this will help someone using the PATs in TFS/VSTS.

Note: HTTPS is needed for BASIC Authentication!