Coder.com•5mo ago

Gitlab git functionality not working after token refresh after workspace is created

Hey all, I'm using Gitlab external auth for my git functionality currently. The GIT_ASKPASS interraction works just fine when I create a new workspace, but after ~12h or so (seemingly this line up with the tokens expiration + renewal but I'm not positive) I start seeing the folowing error:

remote: HTTP Basic: Access denied. The provided password or token is incorrect or your account has 2FA enabled and you must use a personal access token instead of a password. See https://gitlab.com/help/topics/git/troubleshooting_git#error-on-git-fetch-http-basic-access-denied
fatal: Authentication failed for 'MY_REPO'

remote: HTTP Basic: Access denied. The provided password or token is incorrect or your account has 2FA enabled and you must use a personal access token instead of a password. See https://gitlab.com/help/topics/git/troubleshooting_git#error-on-git-fetch-http-basic-access-denied
fatal: Authentication failed for 'MY_REPO'

This is strange, as if I run coder external-auth access-token gitlab within that workspace the token it produces works with git if I simply set the user to oauth2 and the the password to that token in my git repo using git remote set-url origin https://oauth2:MY_TOKEN@MY_REPO, but ofc once the token refreshes that no longer works. I'm not doing any of that on the workspace startup, but I am setting GIT_USERNAME and GIT_PASSWORD since I'm using envbuilder: the git actions work during build with those and, once the workspace is created, I see no GIT-related environment variables other than those I'd expect with a vanilla configuration:

$ env | grep GIT
GIT_SSH_COMMAND=/tmp/coder.X2w8uz/coder gitssh --
GIT_COMMITTER_NAME=removed
GIT_ASKPASS=/tmp/coder.X2w8uz/coder
GIT_AUTHOR_EMAIL=removed
GIT_COMMITTER_EMAIL=removed
GIT_AUTHOR_NAME=removed

$ env | grep GIT
GIT_SSH_COMMAND=/tmp/coder.X2w8uz/coder gitssh --
GIT_COMMITTER_NAME=removed
GIT_ASKPASS=/tmp/coder.X2w8uz/coder
GIT_AUTHOR_EMAIL=removed
GIT_COMMITTER_EMAIL=removed
GIT_AUTHOR_NAME=removed

Any ideas?

Solution:

This has been resolved in https://github.com/coder/envbuilder/pull/141...

GitHub

fix: do not inject GIT_USERNAME and GIT_PASSWORD into git clone URL...

Fixes #126 We had been writing the GIT_USERNAME and GIT_PASSWORD into the git auth URL as well as setting basic HTTP auth credentials. This causes GIT_USERNAME and GIT_PASSWORD to be present in the...

Jump to solution

7 Replies

Codercord•5mo ago

Category: Help needed Product: Coder OSS (v2) What platform are you hosting Coder OSS (v2) on?

mark•5mo ago

O, weird... somehow the oauth2:password is getting into the project's .git/config 🤔 Seems like I can't get envbuilder not to clone the repo in a way that hardcodes the credentials into the .git/config file. As a workaround I'm removing that in the startup script. I don't see any way to influence that configuration.

Phorcys•5mo ago

hey @mark, could you open an issue in the GitHub repo? you will get a faster answer https://github.com/coder/coder/issues

mark•5mo ago

https://github.com/coder/envbuilder/issues/126

GitHub

Gitlab oauth2:token being written to .git/config file after cloning...

I'm using envbuilder 0.2.9 and allowing my users to set the branch portion of the GIT_URL (by using a parameter in the #refs/heads/${data.coder_parameter.repo_branch.value} value) in new worksp...

mark•5mo ago

@Phorcys This strikes me as more of an envbuilder issue so I opened it there. I haven't done any digging yet tho as I'm strapped for time but if I get a second I may open a PR.

Phorcys•5mo ago

alright!

Solution

Atif•4mo ago

This has been resolved in https://github.com/coder/envbuilder/pull/141

GitHub

fix: do not inject GIT_USERNAME and GIT_PASSWORD into git clone URL...

Gaming

Programming

Gitlab git functionality not working after token refresh after workspace is created