How do I set up git-credential-manager-core in Windows to use bitbucket with oauth?

[Arne Hormann]

I cannot get it to work - even after some iterating (azure-repos/generic, ...).

Please help.

We use MS Entra accounts.

In the SSO dialog to access bitbucket in the browser, my email address is firstname.lastname@company.com - logging in works.

My bitbucket user name is firstnamelastname.

This is my current user profile .gitconfig:

---

[user]
name = Firstname Lastname
email = firstname.lastname@company.com

[url "https://firstnamelastname@bitbucket.org/"]
insteadOf = "ssh://git@bitbucket.org/"

[credential]
bitbucketAuthModes = oauth
bitbucketValidateStoredCredentials = true
msauthUseBroker = true

[credential "https://bitbucket.org"]
username = firstname.lastname@company.com

[credential "https://firstnamelastname@bitbucket.org"]
username = firstname.lastname@company.com
provider = azure-repos
allowWindowsAuth = true

[Patrik S]

Hello @Arne Hormann ,

and welcome to the Community!

Can you confirm if when you perform a git operation (such as clone,pull,push), are you prompted to provide the credentials? 

• If yes, can you share a screenshot of the prompt ? 
• If no, it's probably the case your credentials are already cached in your machine. To clear the cache in Windows, you'll need to navigate to Windows Credential manager, and delete any entries related to Bitbucket. Once that is completed, you can try performing the git operation again, and check whether you're prompted for new credentials now.

Thank you, @Arne Hormann !

Patrik S

[Arne Hormann]

Hi Patrik, thanks so much for getting back to me!

I applied a "workaround" and am currently using app passwords - but I would vastly prefer the oauth flow.

I got a graphical username/password dialog popup, but it asked for the username and not the email address and - as there was a password input field - I don't think it's oauth.

I tried various combinations with provider = generic and allowWindowsAuth set to true and to false, username as my bitbucket username and as the company email address, credential URL with https and without, with username and without, ...

Clicking "I cannot use this" or somesuch in the dialog took me straight to the bitbucket website. There, I was allready logged in (SSO there always worked with the company email address). But the command line git connection still failed.

But regardless of my own situation...

How can one set up oauth for Atlassian with an MS account in the credential manager? That's proably a rather common combination. The documentation at https://github.com/git-ecosystem/git-credential-manager/tree/main/docs lacks any examples and looks partially outdated. It only mentions that the bitbucket flow is special. I would expect git config examples in the documentation of the credential manager itself. Experimenting and still failing took me about 2h - and led me to suspect it's not really used anywhere.

So... afaik the credential manager was originally written by MS. Unless I am incompetent in interpreting the instructions (which probably still means they could be improved) - in my opinion, Atlassian should take ownership and improve the documentation and provide examples. The credential manager is part of git for Windows and should be usable and not this puzzling.

Sorry for the wall of text. If you require any additional info, I'll invest more time to provide it. I did this on a quest to write documentation for my coworkers - which I still intend to do.

Thanks!

[Theodora Boudale]

Hi Arne,

I was able to make this work with a ~/.gitconfig like the following:

[user]
    name = Jane Doe
    email = janedoe@example.com
[credential]
     helper = manager
     bitbucketAuthModes = oauth

I installed the latest version of Git and I also installed the Git Credential Manager https://github.com/git-ecosystem/git-credential-manager/tree/main during the Git installation (I was given the choice to do so while installing Git). Then, I cloned a Bitbucket repo from Git Bash with a command like the following:

git clone https://username@bitbucket.org/workspace-id/repo.git

I'm not sure what is the purpose of the additional [credential] entries you have in your own config that are specific to bitbucket.org.

• One thing to note there is that your Bitbucket username (that is used by Git for authentication) is NOT your email address. Your email address can only be used for logging in to the website https://bitbucket.org/ from browser. For Git operations over HTTPS, you can find your Bitbucket username on this page https://bitbucket.org/account/settings/ (after logging in).
• There's also an entry for [credential "https://firstnamelastname@bitbucket.org"] where the provider is set to azure-repos, that doesn't seem to be correct.

Does OAuth work if you use a simple ~/.gitconfig like the one I posted in the beginning of my reply?

If you're still facing issues, the best people to help are the developers of the Git Credential Manager. This tool is not developed by Atlassian so we don't have extensive knowledge on all the config options, expected behavior, bugs, etc. We can give you some guidance based on the available documentation, but its developers will have more extensive knowledge to help.

Kind regards,
Theodora

[Arne Hormann]

Hi Theodora,

that worked for me, thank you very much. I will use it in our internal documentation.

Best regards,

Arne

[Theodora Boudale]

That's good to hear, Arne, thank you for the update.

Please feel free to reach out if you ever need anything else.