Git authentication to GitLab via SSH
Answered
I'm running TeamCity on Windows, running the service using a local user account TeamCity.
I'm trying to set up a Git VCS root to begin configuring a build.
So far, I've created a passwordless RSA key pair using ssh-keygen from within a git bash shell, saved to C:\Users\TeamCity\.ssh\rsa_id and rsa_id.pub. Next I uploaded the public key to GitLab and successfully performed a git clone using the git bash shell - the key is accepted and the server key is added to the known hosts file.
Now, I've created a VCS root with the following settings:
- Type of VCS: Git
- VCS root name: Git Repository
- VCS root ID: Platform_GitRepository
- Fetch URL: git@dev.mycompany.org/mycompany/platform.git
- Default branch: refs/heads/master
For simplicity I have configured the authentication as follows:
- Authentication method: Custom Private Key
- Username: teamcity
- Private key path: C:\Users\TeamCity\.ssh\id_rsa
I'd like to be able to use some of the alternative SSH key options, but I would like to get this to work in its simplest form first.
When pressing the Test Connection button, I get a very terse:
List remote refs failed: com.jcraft.jsch.JSchException: Auth cancel
I've looked in the teamcity-vcs.log file and can see the equivalent exception and stack trace:
[2016-04-07 14:53:24,470] INFO [nio-8000-exec-1] - jetbrains.buildServer.VCS - Error occurred in test connection: jetbrains.buildServer.vcs.VcsException: List remote refs failed: com.jcraft.jsch.JSchException: Auth cancel at jetbrains.buildServer.buildTriggers.vcs.git.OperationContext.wrapException(OperationContext.java:177) at jetbrains.buildServer.buildTriggers.vcs.git.GitVcsSupport.getRemoteRefs(GitVcsSupport.java:360) at jetbrains.buildServer.buildTriggers.vcs.git.GitVcsSupport.getCurrentState(GitVcsSupport.java:139) at jetbrains.buildServer.buildTriggers.vcs.git.TestConnectionCommand.checkFetchConnection(TestConnectionCommand.java:95) at jetbrains.buildServer.buildTriggers.vcs.git.TestConnectionCommand.testConnection(TestConnectionCommand.java:68) at jetbrains.buildServer.buildTriggers.vcs.git.GitVcsSupport.testConnection(GitVcsSupport.java:265) at jetbrains.vcs.api.services.impl.TestConnectionServiceProvider$1.testConnection(TestConnectionServiceProvider.java:1) at jetbrains.buildServer.controllers.admin.projects.TestConnectionCommand.runTestConnection(TestConnectionCommand.java:27) at jetbrains.buildServer.controllers.admin.projects.TestConnectionCommand.doTestConnection(TestConnectionCommand.java:10) at jetbrains.buildServer.controllers.admin.projects.EditVcsRootsController.doPost(EditVcsRootsController.java:184) at jetbrains.buildServer.controllers.BaseFormXmlController$1.handleRequest(BaseFormXmlController.java:53) at jetbrains.buildServer.controllers.AjaxRequestProcessor.processRequest(AjaxRequestProcessor.java:45) at jetbrains.buildServer.controllers.BaseFormXmlController.doHandle(BaseFormXmlController.java:51) at jetbrains.buildServer.controllers.BaseController.handleRequestInternal(BaseController.java:75) at org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:154) at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:50) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:938) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:870) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:961) at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:863) at javax.servlet.http.HttpServlet.service(HttpServlet.java:646) at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:837) at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) at jetbrains.buildServer.maintenance.TeamCityDispatcherServlet.service(TeamCityDispatcherServlet.java:3) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at jetbrains.buildServer.web.DependencyParametersCalculationContextFilter.doFilter(DependencyParametersCalculationContextFilter.java:1) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at jetbrains.buildServer.web.DisableSessionIdFromUrlFilter.doFilter(DisableSessionIdFromUrlFilter.java:6) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at jetbrains.buildServer.diagnostic.web.DiagnosticFilter.doFilter(DiagnosticFilter.java:34) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at jetbrains.buildServer.web.ResponseFragmentFilter.doFilter(ResponseFragmentFilter.java:16) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1074) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1739) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1698) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:745) Caused by: org.eclipse.jgit.errors.TransportException: teamcity@dev.surecloud.com:surecloud/platform.git: Auth cancel at org.eclipse.jgit.transport.JschConfigSessionFactory.getSession(JschConfigSessionFactory.java:159) at org.eclipse.jgit.transport.SshTransport.getSession(SshTransport.java:137) at org.eclipse.jgit.transport.TransportGitSsh$SshFetchConnection.<init>(TransportGitSsh.java:262) at org.eclipse.jgit.transport.TransportGitSsh.openFetch(TransportGitSsh.java:161) at jetbrains.buildServer.buildTriggers.vcs.git.GitVcsSupport.getRemoteRefs(GitVcsSupport.java:378) at jetbrains.buildServer.buildTriggers.vcs.git.GitVcsSupport.getRemoteRefs(GitVcsSupport.java:355) ... 53 more Caused by: com.jcraft.jsch.JSchException: Auth cancel at com.jcraft.jsch.Session.connect(Session.java:511) at org.eclipse.jgit.transport.JschConfigSessionFactory.getSession(JschConfigSessionFactory.java:116) ... 58 more
There doesn't seem to be any more useful information available; I'm not sure how to proceed from here to diagnose why TeamCity isn't able to authenticate with the key specified.
I should also add that I've managed to get a connection to a GitHub account to work with the same key, so it would appear to be a specific combination of JSch and our GitLab server's setup.
Are there any logs available for JSch, or any verbosity switches I could enable? Any suggestions on steps I could take to progress this further?
Please sign in to leave a comment.
Hello Paul,
To get additional logging you can enable 'debug-vcs' logging preset on Administration diagnostics page, reproduce the issue and check the content of teamcity-vcs.log file. Also please check whether GitLab logs contain any clues on why authentication fails.
Do you use submodules?
Having enabled the logging preset and repeated, I'm afraid there's no additional information in the log; the same exception stack appears.
We don't use submodules.
After some more experimenting, it looks like in specifying the `teamcity` username the connection is trying to set up an SSH tunnel with the username `teamcity`. That's not a shell user on the GitLab server; the shell user is `git` (as specified in the SSH URL). The `git` user itself doesn't have rights over any repositories; its just there for SSH tunnels and services.
I believe GitLab is supposed to use the SSH key to determine the GitLab user, even though all users are using `git` as their SSH tunnel principal.
After dealing with some permission issues on the GitLab end I can confirm that removing the username has fixed the issue for me. GitLab wants all users to SSH as the "git" user and will use the key to determine the internal principal.