Re:GitHub access using access token and Basic Authentication no longer working

[Kevin Fleming (BLOOMBERG/ 731 LEXIN)]

You have probably updated to a version of the Git client plugin that uses the Credentials plugin for storage of credentials, and doesn't support URLs with embedded credentials. At least, that seems likely based on what you are reporting. It's certainly not a Jenkins core issue.

----- Original Message -----
From: jenkins...@googlegroups.com
To: jenkins...@googlegroups.com
At: Apr 11 2014 14:16:37

Hi,

I have been using a GitHub personal access token and basic authentication to pull from private GitHub repos from Jenkins. I use the GitHub Plugin, and then for each project, the GitHub Project and Git Repository URL settings are the same, with a format of: https://<user>:<access_token>@github.com/<account>/<repo>/.

This has been working fine for months, until this past Wednesday. Now whenever I build I get an 'Invalid username or password' error (see below).

I recreated the GitHub access token, which didn't fix the problem. I'm think the issue is on the Jenkins side, since I can use the same URL on the command-line to clone the repo, and it works fine.

I upgraded Jenkins to 1.558, but then reverted back to 1.555, thinking the upgrade could have caused the problem. I'm still stuck without being able to pull from GitHub though.

Started by user anonymous
Building on master in workspace c:\build\ProjectA
Fetching changes from the remote Git repository
Fetching upstream changes from https://us...@github.com/account/repo/
FATAL: Failed to fetch from https://us...@github.com/account/repo/
hudson.plugins.git.GitException: Failed to fetch from https://us...@github.com/account/repo/
    at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:623)
    at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:855)
    at hudson.plugins.git.GitSCM.checkout(GitSCM.java:880)
    at hudson.model.AbstractProject.checkout(AbstractProject.java:1414)
    at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:671)
    at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:88)
    at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:580)
    at hudson.model.Run.execute(Run.java:1676)
    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
    at hudson.model.ResourceController.execute(ResourceController.java:88)
    at hudson.model.Executor.run(Executor.java:231)
Caused by: hudson.plugins.git.GitException: Command "git fetch --tags --progress https://us...@github.com/account/repo/ +refs/heads/*:refs/remotes/origin/*" returned status code 128:
stdout:
stderr: remote: Invalid username or password.
fatal: Authentication failed for 'https://us...@github.com/account/repo/'

    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:1276)
    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1146)
    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$200(CliGitAPIImpl.java:87)
    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:254)
    at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:621)
    ... 10 more

--
You received this message because you are subscribed to the Google Groups "Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-use...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

-------------------------------------------------------------------------------

[Mark Waite]

Kevin is correct.  I duplicated the bug you're describing.  A GitHub URL of the form https://username:pass...@github.com/github_username/github_repository does not clone with the current version of the git client plugin (1.8.0) and the current version of the git plugin (2.2.0).

If I take that same username and password and place them in a credential inside Jenkins, then reference that credential from the job definition, it works.

Your workaround is to create a credential which includes that user name and password, then reference that credential from the Jenkins job definition.

I think what you've found is a bug in the git plugin, since I think it should continue to support repository URL's which it supported before.  However, since there is a work around, and since the work around has the benefit that it hides your user name and access token so they are no longer visible in the console log, I don't expect that bug will be fixed very soon.

You could submit a bug report to https://issues.jenkins-ci.org/ so that the problem can be tracked.

Mark Waite

Thanks!

Mark Waite

[Kevin Fleming (BLOOMBERG/ 731 LEXIN)]

Another alternative would be for the plugin to automagically upgrade such URLs and create suitable Credentials for them, so that the user gains the benefits of the new method without their system getting broken.

-------------------------------------------------------------------------------

[Chris Jansen]

Thanks Mark! Worked like a charm.

Kevin, I agree it would have been helfpul if the plugin upgraded the URLs for you. Another nice-to-have would be for the plugin to lok for a basic auth formatted URL on pull failure and generate a more informative error message.

On Friday, April 11, 2014 12:54:06 PM UTC-6, Kevin Fleming wrote:

Another alternative would be for the plugin to automagically upgrade such URLs and create suitable Credentials for them, so that the user gains the benefits of the new method without their system getting broken.

----- Original Message -----
From: jenkins...@googlegroups.com
To: jenkins...@googlegroups.com
At: Apr 11 2014 14:43:42

Kevin is correct.  I duplicated the bug you're describing.  A GitHub URL of the form https://username:password@github.com/github_username/github_repository does not clone with the current version of the git client plugin (1.8.0) and the current version of the git plugin (2.2.0).

-------------------------------------------------------------------------------

[Lily Fu]

I am using

Jenkins 1.555

Git client 1.8.0

Git plugin 2.2.1

 

I was able to use

https://username:pass...@github.com/github_username/github_repository

 

maybe it’s fixed for git plugin 2.2.1 ?

 

Lily

 

From: jenkins...@googlegroups.com [mailto:jenkins...@googlegroups.com] On Behalf Of Chris Jansen
Sent: Friday, April 11, 2014 5:00 PM
To: jenkins...@googlegroups.com
Subject: Re: GitHub access using access token and Basic Authentication no longer working

 

Thanks Mark! Worked like a charm.

Kevin, I agree it would have been helfpul if the plugin upgraded the URLs for you. Another nice-to-have would be for the plugin to lok for a basic auth formatted URL on pull failure and generate a more informative error message.


On Friday, April 11, 2014 12:54:06 PM UTC-6, Kevin Fleming wrote:

Another alternative would be for the plugin to automagically upgrade such URLs and create suitable Credentials for them, so that the user gains the benefits of the new method without their system getting broken.

----- Original Message -----
From: jenkins...@googlegroups.com
To: jenkins...@googlegroups.com
At: Apr 11 2014 14:43:42

Kevin is correct.  I duplicated the bug you're describing.  A GitHub URL of the form https://username:pass...@github.com/github_username/github_repository does not clone with the current version of the git client plugin (1.8.0) and the current version of the git plugin (2.2.0).

-------------------------------------------------------------------------------

[Mark Waite]

That's surprising, since those are the exact versions of the plugins which I used and failed.  I was using an API key and my user name (rather than my actual password).  The username / API key pair worked fine from command line git (embedded in the URL in plaintext) and from a Jenkins credential, but did not work when embedded as plaintext in the URL in the Jenkins job.  

Unfortunately, I can't explain why my results are so different from yours.

Mark Waite

[Lily Fu]

Sorry, I may have mis-led you.

 

It worked for executing from shell…

But for GIT SCM pulling, it does require credential to be set.

 

Lily