Version
2.9.1+6760f0ef069c994aa2bb1d703fb374986ee82a3e
Operating system
Linux
OS version or distribution
Linux codespaces-82a892 6.8.0-1052-azure #58~22.04.1-Ubuntu SMP Thu Mar 26 05:02:21 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Git hosting provider(s)
Azure DevOps
Other hosting provider
No response
(Azure DevOps only) What format is your remote URL?
https://{org}@dev.azure.com/{org}
Can you access the remote repository directly in the browser?
Yes, I can access the repository
Expected behavior
I expect the credential manager to detect the codespaces environment similar to how it detects a devcontainer environment. See LinuxSessionManager.cs#L135
Codespaces can use the same forwarding hook but do not set REMOTE_CONTAINERS=true, they set $CODESPACE_NAME. They also set CODESPACES (but it seems to be false in some codespaces).
Actual behavior
Fall through to devicecode auth which won't work in organizations with Entra Conditional Access enabled.
Note - I can work around this by running export REMOTE_CONTAINERS=derp and perform forwarded browser auth.
Logs
@cbreym_microsoft$ GCM_TRACE=1 git clone https://REDACTED@dev.azure.com/REDACTED/engineering/_git/REDACTED
Cloning into 'REDACTED'...
07:19:58.292544 ...e/Application.cs:106 trace: [RunInternalAsync] Version: 2.9.1.0
07:19:58.295615 ...e/Application.cs:107 trace: [RunInternalAsync] Runtime: .NET 10.0.9
07:19:58.295653 ...e/Application.cs:108 trace: [RunInternalAsync] Platform: Linux (x86-64)
07:19:58.295669 ...e/Application.cs:109 trace: [RunInternalAsync] OSVersion: Ubuntu 24.04.4 LTS
07:19:58.295686 ...e/Application.cs:110 trace: [RunInternalAsync] AppPath: /usr/local/bin/git-credential-manager
07:19:58.295748 ...e/Application.cs:111 trace: [RunInternalAsync] InstallDir: /usr/local/share/gcm-core/
07:19:58.295775 ...e/Application.cs:112 trace: [RunInternalAsync] Arguments: get
07:19:58.322298 ...GitCommandBase.cs:32 trace: [ExecuteAsync] Start 'get' command...
07:19:58.342439 ...GitCommandBase.cs:46 trace: [ExecuteAsync] Detecting host provider for input:
07:19:58.344147 ...GitCommandBase.cs:47 trace: [ExecuteAsync] capability[]=authtype
07:19:58.344168 ...GitCommandBase.cs:47 trace: [ExecuteAsync] capability[]=state
07:19:58.344223 ...GitCommandBase.cs:47 trace: [ExecuteAsync] protocol=https
07:19:58.344237 ...GitCommandBase.cs:47 trace: [ExecuteAsync] host=dev.azure.com
07:19:58.344245 ...GitCommandBase.cs:47 trace: [ExecuteAsync] path=REDACTED/engineering/_git/REDACTED
07:19:58.344254 ...GitCommandBase.cs:47 trace: [ExecuteAsync] username=REDACTED
07:19:58.344280 ...GitCommandBase.cs:47 trace: [ExecuteAsync] wwwauth=Basic realm="https://tfsprodwus23.visualstudio.com/"
07:19:58.347617 ...viderRegistry.cs:149 trace: [GetProviderAsync] Performing auto-detection of host provider.
07:19:58.347986 ...viderRegistry.cs:162 trace: [GetProviderAsync] Auto-detect probe timeout is 2 ms.
07:19:58.350788 ...viderRegistry.cs:170 trace: [GetProviderAsync] Checking against 4 host providers registered with priority 'Normal'.
07:19:58.351559 ...GitCommandBase.cs:49 trace: [ExecuteAsync] Host provider 'Azure Repos' was selected.
07:19:58.355895 ...sHostProvider.cs:499 trace: [UsePersonalAccessTokens] Azure Repos credential type override set to 'oauth'
07:19:58.358046 ...sHostProvider.cs:295 trace: [GetAzureAccessTokenAsync] Determining Microsoft Authentication authority for Azure DevOps organization 'yammer'...
07:19:58.365535 ...AuthorityCache.cs:57 trace: [GetAuthority] Looking up cached authority for organization 'yammer'...
07:19:58.369563 ...sHostProvider.cs:307 trace: [GetAzureAccessTokenAsync] No cached authority value - querying https://dev.azure.com/REDACTED for authority...
07:19:58.371998 ...eDevOpsRestApi.cs:43 trace: [GetAuthorityAsync] HTTP: HEAD https://dev.azure.com/REDACTED
07:19:58.373749 ...pClientFactory.cs:60 trace: [CreateClient] Creating new HTTP client instance...
07:19:58.377370 ...pClientFactory.cs:80 trace: [CreateClient] Git's SSL/TLS backend is: OpenSsl
07:19:58.623355 ...eDevOpsRestApi.cs:46 trace: [GetAuthorityAsync] HTTP: Response code ignored.
07:19:58.623395 ...eDevOpsRestApi.cs:47 trace: [GetAuthorityAsync] Inspecting headers...
07:19:58.625971 ...eDevOpsRestApi.cs:54 trace: [GetAuthorityAsync] Found WWW-Authenticate header with Bearer authority 'https://login.microsoftonline.com/REDACTED'.
07:19:58.626701 ...AuthorityCache.cs:74 trace: [UpdateAuthority] Updating cached authority for 'yammer' to 'https://login.microsoftonline.com/REDACTED'...
07:19:58.631634 ...sHostProvider.cs:317 trace: [GetAzureAccessTokenAsync] Authority is 'https://login.microsoftonline.com/REDACTED'.
07:19:58.631665 ...sHostProvider.cs:339 trace: [GetAzureAccessTokenAsync] Looking up user for organization 'yammer'...
07:19:58.632128 ...BindingManager.cs:94 trace: [GetBinding] Looking up organization binding for 'yammer'...
07:19:58.640784 ...sHostProvider.cs:343 trace: [GetAzureAccessTokenAsync] No user found.
07:19:58.640812 ...sHostProvider.cs:346 trace: [GetAzureAccessTokenAsync] Getting Azure AD access token...
07:19:58.643737 ...uthentication.cs:145 trace: [GetTokenForUserAsync] OS broker is not available or enabled.
07:19:58.643760 ...uthentication.cs:151 trace: [GetTokenForUserAsync] MSA passthrough is enabled.
07:19:58.644022 ...uthentication.cs:478 trace: [GetFlowType] Microsoft auth flow overriden to 'system'.
07:19:58.644687 ...uthentication.cs:156 trace: [GetTokenForUserAsync] Flow type is: 'SystemWebView'.
07:19:58.644784 ...uthentication.cs:172 trace: [GetTokenForUserAsync] Redirect URI is 'http://localhost/'.
07:19:58.659930 ...uthentication.cs:713 trace: [RegisterTokenCacheAsync] Configuring MSAL token cache...
warning: cannot persist Microsoft authentication token cache securely!
07:19:58.703093 ...uthentication.cs:737 trace: [RegisterTokenCacheAsync] Cannot persist Microsoft Authentication data securely!
07:19:58.703275 ...uthentication.cs:738 trace: [RegisterTokenCacheAsync] ! error: 'Persistence check failed. Inspect inner exception for details'.
07:19:58.703300 ...uthentication.cs:738 trace: [RegisterTokenCacheAsync] > 'Unable to load shared library 'libsecret-1.so.0' or one of its dependencies. In order to help diagnose loading problems, consider using a tool like strace. If you're using glibc, consider setting the LD_DEBUG environment variable:
/usr/local/share/gcm-core/libsecret-1.so.0: cannot open shared object file: No such file or directory
/usr/local/share/gcm-core/liblibsecret-1.so.0: cannot open shared object file: No such file or directory
/usr/local/share/gcm-core/libsecret-1.so.0.so: cannot open shared object file: No such file or directory
/usr/local/share/gcm-core/liblibsecret-1.so.0.so: cannot open shared object file: No such file or directory
'.
warning: using plain-text fallback token cache
07:19:58.703630 ...uthentication.cs:754 trace: [RegisterTokenCacheAsync] Using fall-back plaintext token cache on Linux.
07:19:58.704571 ...uthentication.cs:768 trace: [RegisterTokenCacheAsync] Token cache configured.
07:19:58.705028 ...uthentication.cs:259 trace: [GetTokenForUserAsync] Performing interactive auth with system web view...
07:19:58.709676 ...essionManager.cs:141 trace: [GetWebBrowserAvailable] VSCode (Remote Tunnel) detected - browser is not available.
fatal: System web view is not available without a way to start a browser.
at GitCredentialManager.Authentication.MicrosoftAuthentication.EnsureCanUseSystemWebView(Uri redirectUri)
at GitCredentialManager.Authentication.MicrosoftAuthentication.GetTokenForUserAsync(String authority, String clientId, Uri redirectUri, String[] scopes, String userName, Boolean msaPt)
at Microsoft.AzureRepos.AzureReposHostProvider.GetAzureAccessTokenAsync(InputArguments input)
at Microsoft.AzureRepos.AzureReposHostProvider.GetCredentialAsync(InputArguments input)
at GitCredentialManager.Commands.GetCommand.ExecuteInternalAsync(InputArguments input, IHostProvider provider)
at GitCredentialManager.Commands.GitCommandBase.ExecuteAsync()
at System.CommandLine.Invocation.AnonymousCommandHandler.InvokeAsync(InvocationContext context)
at System.CommandLine.Invocation.InvocationPipeline.<>c__DisplayClass4_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass17_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass15_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass12_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass22_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass19_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__18_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass16_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__5_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass8_0.<b__0>d.MoveNext()
07:20:31.748684 ...e/Application.cs:106 trace: [RunInternalAsync] Version: 2.9.1.0
07:20:31.751779 ...e/Application.cs:107 trace: [RunInternalAsync] Runtime: .NET 10.0.9
07:20:31.751806 ...e/Application.cs:108 trace: [RunInternalAsync] Platform: Linux (x86-64)
07:20:31.751814 ...e/Application.cs:109 trace: [RunInternalAsync] OSVersion: Ubuntu 24.04.4 LTS
07:20:31.751833 ...e/Application.cs:110 trace: [RunInternalAsync] AppPath: /usr/local/bin/git-credential-manager
07:20:31.751903 ...e/Application.cs:111 trace: [RunInternalAsync] InstallDir: /usr/local/share/gcm-core/
07:20:31.751942 ...e/Application.cs:112 trace: [RunInternalAsync] Arguments: erase
Version
2.9.1+6760f0ef069c994aa2bb1d703fb374986ee82a3e
Operating system
Linux
OS version or distribution
Linux codespaces-82a892 6.8.0-1052-azure #58~22.04.1-Ubuntu SMP Thu Mar 26 05:02:21 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Git hosting provider(s)
Azure DevOps
Other hosting provider
No response
(Azure DevOps only) What format is your remote URL?
https://{org}@dev.azure.com/{org}
Can you access the remote repository directly in the browser?
Yes, I can access the repository
Expected behavior
I expect the credential manager to detect the codespaces environment similar to how it detects a devcontainer environment. See LinuxSessionManager.cs#L135
Codespaces can use the same forwarding hook but do not set REMOTE_CONTAINERS=true, they set $CODESPACE_NAME. They also set CODESPACES (but it seems to be false in some codespaces).
Actual behavior
Fall through to devicecode auth which won't work in organizations with Entra Conditional Access enabled.
Note - I can work around this by running
export REMOTE_CONTAINERS=derpand perform forwarded browser auth.Logs
@cbreym_microsoft$ GCM_TRACE=1 git clone https://REDACTED@dev.azure.com/REDACTED/engineering/_git/REDACTED
Cloning into 'REDACTED'...
07:19:58.292544 ...e/Application.cs:106 trace: [RunInternalAsync] Version: 2.9.1.0
07:19:58.295615 ...e/Application.cs:107 trace: [RunInternalAsync] Runtime: .NET 10.0.9
07:19:58.295653 ...e/Application.cs:108 trace: [RunInternalAsync] Platform: Linux (x86-64)
07:19:58.295669 ...e/Application.cs:109 trace: [RunInternalAsync] OSVersion: Ubuntu 24.04.4 LTS
07:19:58.295686 ...e/Application.cs:110 trace: [RunInternalAsync] AppPath: /usr/local/bin/git-credential-manager
07:19:58.295748 ...e/Application.cs:111 trace: [RunInternalAsync] InstallDir: /usr/local/share/gcm-core/
07:19:58.295775 ...e/Application.cs:112 trace: [RunInternalAsync] Arguments: get
07:19:58.322298 ...GitCommandBase.cs:32 trace: [ExecuteAsync] Start 'get' command...
07:19:58.342439 ...GitCommandBase.cs:46 trace: [ExecuteAsync] Detecting host provider for input:
07:19:58.344147 ...GitCommandBase.cs:47 trace: [ExecuteAsync] capability[]=authtype
07:19:58.344168 ...GitCommandBase.cs:47 trace: [ExecuteAsync] capability[]=state
07:19:58.344223 ...GitCommandBase.cs:47 trace: [ExecuteAsync] protocol=https
07:19:58.344237 ...GitCommandBase.cs:47 trace: [ExecuteAsync] host=dev.azure.com
07:19:58.344245 ...GitCommandBase.cs:47 trace: [ExecuteAsync] path=REDACTED/engineering/_git/REDACTED
07:19:58.344254 ...GitCommandBase.cs:47 trace: [ExecuteAsync] username=REDACTED
07:19:58.344280 ...GitCommandBase.cs:47 trace: [ExecuteAsync] wwwauth=Basic realm="https://tfsprodwus23.visualstudio.com/"
07:19:58.347617 ...viderRegistry.cs:149 trace: [GetProviderAsync] Performing auto-detection of host provider.
07:19:58.347986 ...viderRegistry.cs:162 trace: [GetProviderAsync] Auto-detect probe timeout is 2 ms.
07:19:58.350788 ...viderRegistry.cs:170 trace: [GetProviderAsync] Checking against 4 host providers registered with priority 'Normal'.
07:19:58.351559 ...GitCommandBase.cs:49 trace: [ExecuteAsync] Host provider 'Azure Repos' was selected.
07:19:58.355895 ...sHostProvider.cs:499 trace: [UsePersonalAccessTokens] Azure Repos credential type override set to 'oauth'
07:19:58.358046 ...sHostProvider.cs:295 trace: [GetAzureAccessTokenAsync] Determining Microsoft Authentication authority for Azure DevOps organization 'yammer'...
07:19:58.365535 ...AuthorityCache.cs:57 trace: [GetAuthority] Looking up cached authority for organization 'yammer'...
07:19:58.369563 ...sHostProvider.cs:307 trace: [GetAzureAccessTokenAsync] No cached authority value - querying https://dev.azure.com/REDACTED for authority...
07:19:58.371998 ...eDevOpsRestApi.cs:43 trace: [GetAuthorityAsync] HTTP: HEAD https://dev.azure.com/REDACTED
07:19:58.373749 ...pClientFactory.cs:60 trace: [CreateClient] Creating new HTTP client instance...
07:19:58.377370 ...pClientFactory.cs:80 trace: [CreateClient] Git's SSL/TLS backend is: OpenSsl
07:19:58.623355 ...eDevOpsRestApi.cs:46 trace: [GetAuthorityAsync] HTTP: Response code ignored.
07:19:58.623395 ...eDevOpsRestApi.cs:47 trace: [GetAuthorityAsync] Inspecting headers...
07:19:58.625971 ...eDevOpsRestApi.cs:54 trace: [GetAuthorityAsync] Found WWW-Authenticate header with Bearer authority 'https://login.microsoftonline.com/REDACTED'.
07:19:58.626701 ...AuthorityCache.cs:74 trace: [UpdateAuthority] Updating cached authority for 'yammer' to 'https://login.microsoftonline.com/REDACTED'...
07:19:58.631634 ...sHostProvider.cs:317 trace: [GetAzureAccessTokenAsync] Authority is 'https://login.microsoftonline.com/REDACTED'.
07:19:58.631665 ...sHostProvider.cs:339 trace: [GetAzureAccessTokenAsync] Looking up user for organization 'yammer'...
07:19:58.632128 ...BindingManager.cs:94 trace: [GetBinding] Looking up organization binding for 'yammer'...
07:19:58.640784 ...sHostProvider.cs:343 trace: [GetAzureAccessTokenAsync] No user found.
07:19:58.640812 ...sHostProvider.cs:346 trace: [GetAzureAccessTokenAsync] Getting Azure AD access token...
07:19:58.643737 ...uthentication.cs:145 trace: [GetTokenForUserAsync] OS broker is not available or enabled.
07:19:58.643760 ...uthentication.cs:151 trace: [GetTokenForUserAsync] MSA passthrough is enabled.
07:19:58.644022 ...uthentication.cs:478 trace: [GetFlowType] Microsoft auth flow overriden to 'system'.
07:19:58.644687 ...uthentication.cs:156 trace: [GetTokenForUserAsync] Flow type is: 'SystemWebView'.
07:19:58.644784 ...uthentication.cs:172 trace: [GetTokenForUserAsync] Redirect URI is 'http://localhost/'.
07:19:58.659930 ...uthentication.cs:713 trace: [RegisterTokenCacheAsync] Configuring MSAL token cache...
warning: cannot persist Microsoft authentication token cache securely!
07:19:58.703093 ...uthentication.cs:737 trace: [RegisterTokenCacheAsync] Cannot persist Microsoft Authentication data securely!
07:19:58.703275 ...uthentication.cs:738 trace: [RegisterTokenCacheAsync] ! error: 'Persistence check failed. Inspect inner exception for details'.
07:19:58.703300 ...uthentication.cs:738 trace: [RegisterTokenCacheAsync] > 'Unable to load shared library 'libsecret-1.so.0' or one of its dependencies. In order to help diagnose loading problems, consider using a tool like strace. If you're using glibc, consider setting the LD_DEBUG environment variable:
/usr/local/share/gcm-core/libsecret-1.so.0: cannot open shared object file: No such file or directory
/usr/local/share/gcm-core/liblibsecret-1.so.0: cannot open shared object file: No such file or directory
/usr/local/share/gcm-core/libsecret-1.so.0.so: cannot open shared object file: No such file or directory
/usr/local/share/gcm-core/liblibsecret-1.so.0.so: cannot open shared object file: No such file or directory
'.
warning: using plain-text fallback token cache
07:19:58.703630 ...uthentication.cs:754 trace: [RegisterTokenCacheAsync] Using fall-back plaintext token cache on Linux.
07:19:58.704571 ...uthentication.cs:768 trace: [RegisterTokenCacheAsync] Token cache configured.
07:19:58.705028 ...uthentication.cs:259 trace: [GetTokenForUserAsync] Performing interactive auth with system web view...
07:19:58.709676 ...essionManager.cs:141 trace: [GetWebBrowserAvailable] VSCode (Remote Tunnel) detected - browser is not available.
fatal: System web view is not available without a way to start a browser.
at GitCredentialManager.Authentication.MicrosoftAuthentication.EnsureCanUseSystemWebView(Uri redirectUri)
at GitCredentialManager.Authentication.MicrosoftAuthentication.GetTokenForUserAsync(String authority, String clientId, Uri redirectUri, String[] scopes, String userName, Boolean msaPt)
at Microsoft.AzureRepos.AzureReposHostProvider.GetAzureAccessTokenAsync(InputArguments input)
at Microsoft.AzureRepos.AzureReposHostProvider.GetCredentialAsync(InputArguments input)
at GitCredentialManager.Commands.GetCommand.ExecuteInternalAsync(InputArguments input, IHostProvider provider)
at GitCredentialManager.Commands.GitCommandBase.ExecuteAsync()
at System.CommandLine.Invocation.AnonymousCommandHandler.InvokeAsync(InvocationContext context)
at System.CommandLine.Invocation.InvocationPipeline.<>c__DisplayClass4_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass17_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass15_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass12_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass22_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass19_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__18_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass16_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__5_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass8_0.<b__0>d.MoveNext()
07:20:31.748684 ...e/Application.cs:106 trace: [RunInternalAsync] Version: 2.9.1.0
07:20:31.751779 ...e/Application.cs:107 trace: [RunInternalAsync] Runtime: .NET 10.0.9
07:20:31.751806 ...e/Application.cs:108 trace: [RunInternalAsync] Platform: Linux (x86-64)
07:20:31.751814 ...e/Application.cs:109 trace: [RunInternalAsync] OSVersion: Ubuntu 24.04.4 LTS
07:20:31.751833 ...e/Application.cs:110 trace: [RunInternalAsync] AppPath: /usr/local/bin/git-credential-manager
07:20:31.751903 ...e/Application.cs:111 trace: [RunInternalAsync] InstallDir: /usr/local/share/gcm-core/
07:20:31.751942 ...e/Application.cs:112 trace: [RunInternalAsync] Arguments: erase