Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 356233

Summary: EGit needs to clear cached passwords if ssh authentication fails
Product: [Technology] EGit Reporter: Chris Goldthorpe <cgold>
Component: UIAssignee: Matthias Sohn <matthias.sohn>
Status: RESOLVED FIXED QA Contact:
Severity: blocker    
Priority: P3 CC: amj87.iitr, daniel_megert, david_williams, deepakazad, john.arthorne, juergen.pasch, kim.moir, markus.kell.r, matthias.sohn, matthieu.melot, Michael_Rennie, remy.suen, satyam.kandula, srikanth_sankaran
Version: 1.1   
Target Milestone: 1.2   
Hardware: PC   
OS: Windows 7   
Whiteboard:
Attachments:
Description Flags
Error dialog
none
Screen shot on failed fetch
none
screenshot showing how to clear credentials
none
screenshot showing how to clear credentials none

Description Chris Goldthorpe CLA 2011-08-30 13:21:54 EDT 
1.1.0.201108281820

I recently changed my committer password and found that any push or synchronize operation failed with an ssh authentication error. I was unable to do anything until I cleared out the cached password using the Eclipse preferences. I think this is a major usability problem because everyone will run into it sooner or later and it is not at all obvious how to recover. 

To reproduce without changing your password:

1. Start Eclipse with Git installed and clone a password protected repository.
2. In the preference page General/Security/Secure Storage go to the contents tab, expand Default Secure Storage and delete the GIT entries. It will ask you to restart Eclipse which you should do.
3. Select a project in the package explore and perform a Git Pull, you will be asked for a password
4. Enter an incorrect value for the password and leave the checkbox "Store in Secure Store" checked.
5. The pull will fail and show the attached error dialog
6. Pull again, it will fail 
7. If you synchronize workspace instead of pull it will show the exception below in the error log.
Repeat step 2 to clear out the bad password. A pull will now prompt you for a password and will work correctly.

org.eclipse.core.runtime.CoreException: ssh://cgoldthor@git.eclipse.org/gitroot/platform/eclipse.platform.ua.git: Auth fail
	at org.eclipse.egit.ui.internal.fetch.FetchOperationUI.execute(FetchOperationUI.java:102)
	at org.eclipse.egit.ui.internal.synchronize.SynchronizeFetchJob.run(SynchronizeFetchJob.java:75)
	at org.eclipse.core.internal.jobs.Worker.run(Worker.java:54)
Caused by: org.eclipse.jgit.errors.TransportException: ssh://cgoldthor@git.eclipse.org/gitroot/platform/eclipse.platform.ua.git: Auth fail
	at org.eclipse.jgit.transport.JschConfigSessionFactory.getSession(JschConfigSessionFactory.java:138)
	at org.eclipse.jgit.transport.SshTransport.getSession(SshTransport.java:121)
	at org.eclipse.jgit.transport.TransportGitSsh$SshFetchConnection.<init>(TransportGitSsh.java:248)
	at org.eclipse.jgit.transport.TransportGitSsh.openFetch(TransportGitSsh.java:147)
	at org.eclipse.jgit.transport.FetchProcess.executeImp(FetchProcess.java:127)
	at org.eclipse.jgit.transport.FetchProcess.execute(FetchProcess.java:113)
	at org.eclipse.jgit.transport.Transport.fetch(Transport.java:1062)
	at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:136)
	at org.eclipse.egit.core.op.FetchOperation.run(FetchOperation.java:128)
	at org.eclipse.egit.ui.internal.fetch.FetchOperationUI.execute(FetchOperationUI.java:99)
	... 2 more
Caused by: com.jcraft.jsch.JSchException: Auth fail
	at com.jcraft.jsch.Session.connect(Session.java:461)
	at org.eclipse.jgit.transport.JschConfigSessionFactory.getSession(JschConfigSessionFactory.java:128)
	... 11 more
Comment 1 Chris Goldthorpe CLA 2011-08-30 13:22:34 EDT 
Created attachment 202445 [details]
Error dialog
Comment 2 John Arthorne CLA 2011-09-22 16:48:46 EDT 
Created attachment 203867 [details]
Screen shot on failed fetch

I updated by eclipse.org password today and I hit this too. Everything I tried to do was just failing with exceptions. See for example this JGitInternalException dialog trying to fetch. There is no indication that this is a password problem, until I looked through the error log and found the tell-tale "Auth fail" indicating a jsch login failure.
Comment 3 Markus Keller CLA 2011-10-03 10:44:28 EDT 
Ran into this too after I had to change my SSH password. This has a high potential for locking out people if they repeatedly try to log in with the old password.
Comment 4 Markus Keller CLA 2011-10-03 11:20:00 EDT 
Together with bug 260530, this causes a lot of unnecessary work.

Workaround is to shut down Eclipse and then manually remove the lines in the <userdir>/.eclipse/org.eclipse.equinox.security/secure_storage file.
Comment 5 John Arthorne CLA 2011-10-03 16:12:21 EDT 
(In reply to comment #4)
> Workaround is to shut down Eclipse and then manually remove the lines in the
> <userdir>/.eclipse/org.eclipse.equinox.security/secure_storage file.

You can also do Preference > General > Security > Secure Storage > Contents > Delete.
Comment 6 Markus Keller CLA 2011-10-04 14:05:10 EDT 
> You can also do Preference > General > Security > Secure Storage > Contents >
> Delete.

No, that is the "a lot of unnecessary work" part!

The Delete button deletes the *entire* secure storage, see bug 260530. If you have other stored passwords, you have to re-enter them all.
Comment 7 Matthias Sohn CLA 2011-10-09 17:50:24 EDT 
As a manual workaround you may clear credentials in Repositories View:
- click "Clear credentials" or "Change credentials" on the push or fetch URL (see attached screenshot)
Comment 8 Matthias Sohn CLA 2011-10-09 17:51:35 EDT 
Created attachment 204842 [details]
screenshot showing how to clear credentials
Comment 9 Matthias Sohn CLA 2011-10-09 17:53:52 EDT 
Created attachment 204844 [details]
screenshot showing how to clear credentials
Comment 10 Matthieu Melot CLA 2011-10-20 16:34:09 EDT 
(In reply to comment #9)
> Created attachment 204844 [details]
> screenshot showing how to clear credentials

For me the "clear credentials" option didn't work, even with a subsequent Eclipse restart, I had to delete the lines in the file as Markus Keller said.
Comment 11 Juergen Pasch CLA 2011-11-10 05:04:09 EST 
This problem also occurs when working with https.
Comment 12 Deepak Azad CLA 2011-11-10 10:10:25 EST 
Sigh.. this bug resulted in IBM Bangalore office getting blocked, which meant about 10 committers could not access git.eclipse.org for a while :(

Bumping up the severity, as the bug can result in a bunch of people literally getting blocked from git.eclipse.org.

Any plans for getting this fixed?
Comment 13 Srikanth Sankaran CLA 2011-11-10 23:30:05 EST 
*** Bug 363262 has been marked as a duplicate of this bug. ***
Comment 14 Srikanth Sankaran CLA 2011-11-10 23:31:48 EST 
(In reply to comment #10)
> (In reply to comment #9)
> > Created attachment 204844 [details] [details]
> > screenshot showing how to clear credentials
> 
> For me the "clear credentials" option didn't work, even with a subsequent
> Eclipse restart, I had to delete the lines in the file as Markus Keller said.

Ditto for me. As folks have observed, this blocks out not only the
unfortunate individual, but also whole teams working from the same site.
Comment 15 Matthias Sohn CLA 2011-11-17 17:47:51 EST 
Pushed http://egit.eclipse.org/r/#change,4621 for review to fix failing "Clear credentials" when default port is used which is true for git ssh access at Eclipse.org.
Comment 16 Matthias Sohn CLA 2011-11-25 10:38:56 EST 
fix for clearing credentials was merged as 47085941efb58da44b75f1c624a5eaca875daa09
Comment 17 Matthias Sohn CLA 2011-11-25 16:09:44 EST 
Pushed patches to fix this for review

JGit: http://egit.eclipse.org/r/#change,4676
EGit: http://egit.eclipse.org/r/#change,4677
Comment 18 Matthias Sohn CLA 2011-11-30 15:48:22 EST 
JGit change merged as 430395a6690afcc8dedc2a8425f731668f071eaa
EGit change merged as 41de765e17ac9047e614f57367b0b1e140b1f66b