JBoss BxMS 6.3 throws TransportException "authentication not supported" by cloning git repository hosted by Microsoft TFS

Solution Unverified - Updated -

Environment

  • Red Hat JBoss BRMS (BRMS) 6.3
  • Red Hat JBoss BPM Suite (BPMS) 6.3
  • Microsoft Team Foundation Server (TFS)

Issue

BPMS 6.3 throws a TransportException error by trying to clone from a Git repository hosted by Microsoft Team Foundation Server:

17:54:51,939 ERROR [org.guvnor.structure.backend.repositories.RepositoryServiceImpl] (http-127.0.0.1:8080-6) Error during create repository: java.lang.RuntimeException: http://myserver/tfs/DefaultCollection/_git/MyProject1: authentication not supported
        at org.guvnor.structure.backend.repositories.git.GitRepositoryBuilder.createFileSystem(GitRepositoryBuilder.java:139) [guvnor-structure-backend-6.4.0.Final-redhat-3.jar:6.4.0.Final-redhat-3]
...
Caused by: java.lang.RuntimeException: org.eclipse.jgit.api.errors.TransportException: http://myserver/tfs/DefaultCollection/_git/MyProject1: authentication not supported
        at org.uberfire.java.nio.fs.jgit.util.JGitUtil.cloneRepository(JGitUtil.java:250) [uberfire-nio2-jgit-0.8.0.Final-redhat-3.jar:0.8.0.Final-redhat-3]
        at org.uberfire.java.nio.fs.jgit.JGitFileSystemProvider.newFileSystem(JGitFileSystemProvider.java:693) [uberfire-nio2-jgit-0.8.0.Final-redhat-3.jar:0.8.0.Final-redhat-3]
        at org.uberfire.java.nio.file.FileSystems.newFileSystem(FileSystems.java:117) [uberfire-nio2-api-0.8.0.Final-redhat-3.jar:0.8.0.Final-redhat-3]
        at org.uberfire.java.nio.file.FileSystems.newFileSystem(FileSystems.java:83) [uberfire-nio2-api-0.8.0.Final-redhat-3.jar:0.8.0.Final-redhat-3]
        at org.uberfire.io.impl.AbstractIOService.newFileSystem(AbstractIOService.java:244) [uberfire-io-0.8.0.Final-redhat-3.jar:0.8.0.Final-redhat-3]
        at org.uberfire.ext.metadata.io.IOServiceIndexedImpl.newFileSystem(IOServiceIndexedImpl.java:198) [uberfire-metadata-commons-io-0.8.0.Final-redhat-3.jar:0.8.0.Final-redhat-3]
        at org.guvnor.structure.backend.repositories.git.GitRepositoryBuilder.createFileSystem(GitRepositoryBuilder.java:130) [guvnor-structure-backend-6.4.0.Final-redhat-3.jar:6.4.0.Final-redhat-3]
        ... 47 more
Caused by: org.eclipse.jgit.api.errors.TransportException: http://myserver/tfs/DefaultCollection/_git/MyProject1: authentication not supported
        at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:139) [org.eclipse.jgit-3.7.1.201504261725-r.jar:3.7.1.201504261725-r]
        at org.eclipse.jgit.api.CloneCommand.fetch(CloneCommand.java:193) [org.eclipse.jgit-3.7.1.201504261725-r.jar:3.7.1.201504261725-r]
        at org.eclipse.jgit.api.CloneCommand.call(CloneCommand.java:133) [org.eclipse.jgit-3.7.1.201504261725-r.jar:3.7.1.201504261725-r]
        at org.uberfire.java.nio.fs.jgit.util.JGitUtil.cloneRepository(JGitUtil.java:229) [uberfire-nio2-jgit-0.8.0.Final-redhat-3.jar:0.8.0.Final-redhat-3]
        ... 53 more
Caused by: org.eclipse.jgit.errors.TransportException: http://myserver/tfs/DefaultCollection/_git/MyProject1: authentication not supported
        at org.eclipse.jgit.transport.TransportHttp.connect(TransportHttp.java:494) [org.eclipse.jgit-3.7.1.201504261725-r.jar:3.7.1.201504261725-r]
        at org.eclipse.jgit.transport.TransportHttp.openFetch(TransportHttp.java:309) [org.eclipse.jgit-3.7.1.201504261725-r.jar:3.7.1.201504261725-r]
        at org.eclipse.jgit.transport.FetchProcess.executeImp(FetchProcess.java:136) [org.eclipse.jgit-3.7.1.201504261725-r.jar:3.7.1.201504261725-r]
        at org.eclipse.jgit.transport.FetchProcess.execute(FetchProcess.java:122) [org.eclipse.jgit-3.7.1.201504261725-r.jar:3.7.1.201504261725-r]
        at org.eclipse.jgit.transport.Transport.fetch(Transport.java:1138) [org.eclipse.jgit-3.7.1.201504261725-r.jar:3.7.1.201504261725-r]
        at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:130) [org.eclipse.jgit-3.7.1.201504261725-r.jar:3.7.1.201504261725-r]
        ... 56 more

Resolution

There are three suggested workarounds:

  1. Change it to Basic authentication at TFS side;
  2. Clone the repository with any other tool (e.g. git command) to the local filesystem, then BxMS will be able to clone the repository from it. If you will push the changes back to TFS in the future, you would want direct access.
  3. Use Cntlm, a locally-installed proxy that adds NTLM authentication on-the-fly.

Root Cause

The error authentication not supported is raised when JGit cannot find supported authentication methods in Http header WWW-Authenticate: from the TFS server HTTP response 401.

WWW-Authenticate: NTLM is requested from TFS, but NTLM is not naturally supported by JGit (regardless of version 3.7.1 / 4.4.1).

Diagnostic Steps

  • Confirm authentication method of the TFS
    • If NTLM, the issue meets this article
  • Component
  • git

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments