Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-28165

git plugin does not support username/password over ssh

    • Icon: Improvement Improvement
    • Resolution: Duplicate
    • Icon: Major Major
    • git-plugin
    • None

      I have jenkins installed on a Ubuntu machine. I have a git repo hosted on a different Ubuntu server that I usually access via ssh. I created a new build project and I am just trying to get the git fetch working. I defined the URL correctly and created a new set of credentials that are a username and password. I am getting the error in the attached file. I don't know how else to debug this problem. I ran the following command in a terminal on my jenkins server (running as the jenkins user) and it prompted me for my password. When I entered the password, it printed nothing to the standard out or standard error.

      git -c core.askpass=true ls-remote -h mobius-test@blue.perform.illinois.edu:/srv/git/grp/mobius/Mobius.git HEAD

          [JENKINS-28165] git plugin does not support username/password over ssh

          Mark Waite added a comment -

          That line usually means the call to "git fetch" failed. In your case, the message from the git fetch command:

          Permission denied, please try again.
          Permission denied, please try again.
          Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
          fatal: Could not read from remote repository.
          Please make sure you have the correct access rights
          and the repository exists.
          

          indicates that it is trying to authenticate you and failing.

          I created a multi-configuration job in my test network using various operating systems and git versions with two different forms of username / password authentication. My ssh server in these tests is a Ubuntu 14.04 machine hosting a repository in the directory /var/lib/git/mwaite/bugs/JENKINS-28165.git. The master node is that Ubuntu 14.04 machine with the process running as the jenkins user. The repository is owned by the user mwaite.

          I've run out of time this morning to experiment with this, so won't be able to add more comments on this until after the end of the working day today.

          Mark Waite added a comment - That line usually means the call to "git fetch" failed. In your case, the message from the git fetch command: Permission denied, please try again. Permission denied, please try again. Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. indicates that it is trying to authenticate you and failing. I created a multi-configuration job in my test network using various operating systems and git versions with two different forms of username / password authentication. My ssh server in these tests is a Ubuntu 14.04 machine hosting a repository in the directory /var/lib/git/mwaite/bugs/ JENKINS-28165 .git. The master node is that Ubuntu 14.04 machine with the process running as the jenkins user. The repository is owned by the user mwaite. I've run out of time this morning to experiment with this, so won't be able to add more comments on this until after the end of the working day today.

          Ken Keefe added a comment -

          Thank you for working on this. The only workaround I've discovered so far is to manually ssh into my master and slaves and set up password-less public key authentication between the master and slaves and the repo server. My fetch now works successfully. However, this is very inconvenient since I can't manage my credentials in Jenkins and password-less keys make me very nervous about sharing my Jenkins server with other developers. I really wish there was some nice way to debug the authentication problem when trying to use username/password Jenkins credentials with the git plugin.

          Ken Keefe added a comment - Thank you for working on this. The only workaround I've discovered so far is to manually ssh into my master and slaves and set up password-less public key authentication between the master and slaves and the repo server. My fetch now works successfully. However, this is very inconvenient since I can't manage my credentials in Jenkins and password-less keys make me very nervous about sharing my Jenkins server with other developers. I really wish there was some nice way to debug the authentication problem when trying to use username/password Jenkins credentials with the git plugin.

          Mark Waite added a comment -

          The credentials mechanism in Jenkins will allow you to limit the use of a private key to a specific domain and/or a specific URL scheme (https, ssh, etc.). That allows a private key dedicated to the Jenkins user, with users not allowed to apply that private key anywhere other than the domains for which it is intended.

          Mark Waite added a comment - The credentials mechanism in Jenkins will allow you to limit the use of a private key to a specific domain and/or a specific URL scheme (https, ssh, etc.). That allows a private key dedicated to the Jenkins user, with users not allowed to apply that private key anywhere other than the domains for which it is intended.

          Mark Waite added a comment -

          You may find the gitolite ssh troubleshooting guide as a useful diagnostic.

          Mark Waite added a comment - You may find the gitolite ssh troubleshooting guide as a useful diagnostic.

          Stefan Antal added a comment -

          I have the same issue here. There are two differences on the setup. My git repository is on the same machine as jenkins and I use OS X server. So I'm basically ssh-ing to the same machine. I would like to do that without using keyfiles (not sure if that even works because I'm staying on the same machine).

          How do you guys go your git repo setup with jenkins. I feel like I tried everything.

          Stefan Antal added a comment - I have the same issue here. There are two differences on the setup. My git repository is on the same machine as jenkins and I use OS X server. So I'm basically ssh-ing to the same machine. I would like to do that without using keyfiles (not sure if that even works because I'm staying on the same machine). How do you guys go your git repo setup with jenkins. I feel like I tried everything.

          Mark Waite added a comment -

          stefan_antal ssh to the same machine definitely works, though if you are on the same machine, you may be able to use a git URL which is the absolute path to the repository on the file system.

          Mark Waite added a comment - stefan_antal ssh to the same machine definitely works, though if you are on the same machine, you may be able to use a git URL which is the absolute path to the repository on the file system.

          Stefan Antal added a comment -

          Hi markewaite,

          thanks for your help!

          Somehow I thought the git plugin puts ssh in the beginning. It works with the git-protocol-way.

          Stefan Antal added a comment - Hi markewaite , thanks for your help! Somehow I thought the git plugin puts ssh in the beginning. It works with the git-protocol-way.

          ihsiak Ihs added a comment -

          Same here. I managed to check that Jenkins (1.642.2) does not use selected credential at all, but uses username of owning service ("jenkins") during connection.

          ihsiak Ihs added a comment - Same here. I managed to check that Jenkins (1.642.2) does not use selected credential at all, but uses username of owning service ("jenkins") during connection.

          Chris Eagan added a comment -

          I'm seeing this same problem with Jenkins using SSH username/password authentication. In my case, I have a credential in the credential store with the username and password, but no matter what I do, I can't seem to get the fetch to work. Optimally, Jenkins would read the username and password from the credential store and use them to connect, but it seems to still be defaulting to the username on the system. If I force the username to be the one in the credential store by changing the URL to the git repository in Jenkins, it still fails to perform the checkout. I haven't found a method to get more details than those already provided in this bug report. Does anyone know how I can get more debug output?

          Chris Eagan added a comment - I'm seeing this same problem with Jenkins using SSH username/password authentication. In my case, I have a credential in the credential store with the username and password, but no matter what I do, I can't seem to get the fetch to work. Optimally, Jenkins would read the username and password from the credential store and use them to connect, but it seems to still be defaulting to the username on the system. If I force the username to be the one in the credential store by changing the URL to the git repository in Jenkins, it still fails to perform the checkout. I haven't found a method to get more details than those already provided in this bug report. Does anyone know how I can get more debug output?

          Mark Waite added a comment -

          As far as I know, the git plugin does not support username / password credentials with an ssh connection. I'm able to use a private key / public key credential with an ssh connection, but username / password has never worked for me with ssh.

          If you need username / password, then you'll need to use http or https for that connection.

          Mark Waite added a comment - As far as I know, the git plugin does not support username / password credentials with an ssh connection. I'm able to use a private key / public key credential with an ssh connection, but username / password has never worked for me with ssh. If you need username / password, then you'll need to use http or https for that connection.

            ndeloof Nicolas De Loof
            kjkeefe Ken Keefe
            Votes:
            1 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: