How coder_external_auth work ?

[glenn2wang]

when I use the coder_external_auth, it can auto Clone repo from GitHub when i create workspace or git clone in the terminal.
but in the IDE such like vscode or Jebrains IDEA , when I push or pull code, it still need username & password.

i do not know such thing missed by me, or sothing else

[matifali]

Hi @glenn2wang, you need to inject the GITHUB_TOKEN variable using either

1. Template: Access token from data.coder_external_auth.<NAME>.access_token using coder_agent env block
2. CLI: coder external-auth access-token <EXTERNAL_AUTH_ID>

It would benefit if we also explain this process in our docs.

[matifali]

@kylecarbs to understand it better,
We have two ways for git authentication

1. If users add their Coder SSH public key to GitHub, they are automatically authenticated using GIT_ASKPASS in their workspaces. (This does not allow cloning private repos during workspace creation)
2. If there is EXTERNAL_AUTH configured, they need to inject GITHUB_TOKEN either by CLI or template's data.coder_external_auth.<NAME>.access_token.

What happens if both are configured? Which one takes the priority? Is there a way to prefer one over the other?

cc: @bpmct

[bpmct]

Hey @matifali - to clarify a few things:

• The SSH key does not impact GIT_ASKPASS. It's simply a key injected into the workspace and only applies when someone tries to clone a repo over SSH
• When a user clones over HTTPS, git askpass is used. You don't need to set GITHUB_TOKEN in this case as it uses GIT_ASK_PASS

[matifali]

Thanks Ben. Could you verify my original answer above?

[Emyrk]

@matifali I think GITHUB_TOKEN takes priority. The problem with GITHUB_TOKEN is they can expire. For Gitlab, tokens expire in 2hrs. So using GIT_ASKPASS is pretty much the only way to stay authed in a workspace.

[glenn2wang]

Is gitlab has token such like github_token ?

[glenn2wang]

when i use http to clone
idea cannot use the GIT_ASK_PASS

[matifali]

@glenn2wang This comment seems related to your question.

[thelittlerocket]

I have got a similar problem.
external_auth with gitea then create a workspace, can git clone and git push with either https:// or ssh:// in the terminal without problem, but in the IDE, it will always ask for username and password if using git clone https://.

here are the relevant configs from main.tf

data "coder_external_auth" "gitea" {
  # Matches the ID of the external auth provider in Coder.
  id = "gitea"
}

resource "coder_agent" "main" {
  arch                   = data.coder_provisioner.me.arch
  os                     = "linux"
  startup_script_timeout = 180
  startup_script         = <<-EOT
    set -e

    # install and start code-server
    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.11.0
    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &

  EOT

  # These environment variables allow you to make Git commits right away after creating a
  # workspace. Note that they take precedence over configuration defined in ~/.gitconfig!
  # You can remove this block if you'd prefer to configure Git manually or using
  # dotfiles. (see docs/dotfiles.md)
  env = {
    GIT_AUTHOR_NAME     = "${data.coder_workspace.me.owner}"
    GIT_COMMITTER_NAME  = "${data.coder_workspace.me.owner}"
    GIT_AUTHOR_EMAIL    = "${data.coder_workspace.me.owner_email}"
    GIT_COMMITTER_EMAIL = "${data.coder_workspace.me.owner_email}"
    GITHUB_TOKEN = "${data.coder_external_auth.github.access_token}"
  }

In the terminal, the GITHUB_TOKEN environment variable exists but is not in IDE's terminal, even if I manually export GITHUB_TOKEN in the IDE, it still asks for username/password when git clone https:// .

Any help would be appreciated, thanks,

[matifali]

@Emyrk @ericpaulsen if you have an idea.

[ericpaulsen]

hi all - can you echo $GIT_ASKPASS and echo $GIT_SSH_COMMAND in the workspace?

[joshzarrabi-picnic]

Hi @ericpaulsen Yeah, we think this is the problem. It looks like vscode overwrites those which causes the problem.

[joshzarrabi-picnic]

@ericpaulsen do you have any advice on how to remedy the situation? Getting rid of them seems to mess up the git UI on vscode

[joshzarrabi-picnic]

@ericpaulsen, looks like this worked: microsoft/vscode#144420 (comment). Might want to add some documentation to the coder site