Microsoft Services | Azure | DevOps and SRE | GitHub
Get alerts from GitHub Advanced Security for Azure DevOps 
Rob Bos 02 Sep, 2023
Share 
Sometimes you have these weird things you run into, and I’m sure I will not be able to find this one if I don’t store it here.
Photo by Unsplash Hakan Aldrin
Configuring Git with a PAT token with Azure DevOps
Usually in Windows I use the Windows Credential Manager for storing authentication against remote Git repositories. You can also use the SSH setup that Azure DevOps supports as a widely used alternative.
This time I was setting things up for a user with a Docker container and didn’t want to setup any of those options: I was already using a Personal Access Token for accessing the REST API and wanted to reuse that for the Git repository as well.
Searching around took quite a while until I found an obscure reference within the Git LFS repo that indicated you could setup Git with an extra authorization header with the PAT token in it. Seriously: can’t even find the repo I found this in.
Solution (repo based)
After some messing around I got things working, so here is the solution for future reference.
<span class="kr">function</span><span class="w"> </span><span class="nf">SetupAuthentication</span><span class="w"> </span><span class="p">{</span><span class="w">
</span><span class="kr">param</span><span class="w"> </span><span class="p">(</span><span class="w">
</span><span class="p">[</span><span class="n">string</span><span class="p">]</span><span class="w"> </span><span class="nv">$organization</span><span class="w">
</span><span class="p">[</span><span class="n">string</span><span class="p">]</span><span class="w"> </span><span class="nv">$project</span><span class="w">
</span><span class="p">[</span><span class="n">string</span><span class="p">]</span><span class="w"> </span><span class="nv">$repoName</span><span class="p">,</span><span class="w">
</span><span class="p">[</span><span class="n">string</span><span class="p">]</span><span class="w"> </span><span class="nv">$userName</span><span class="p">,</span><span class="w">
</span><span class="p">[</span><span class="n">string</span><span class="p">]</span><span class="w"> </span><span class="nv">$PAT</span><span class="w">
</span><span class="p">)</span><span class="w">
</span><span class="c"># convert the Personal Access Token to a Base64 encoded string</span><span class="w">
</span><span class="nv">$B64Pat</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">[</span><span class="n">Convert</span><span class="p">]::</span><span class="n">ToBase64String</span><span class="p">([</span><span class="n">System.Text.Encoding</span><span class="p">]::</span><span class="n">UTF8.GetBytes</span><span class="p">(</span><span class="s2">":</span><span class="nv">$PAT</span><span class="s2">"</span><span class="p">))</span><span class="w">
</span><span class="c"># store the extra header for git to use</span><span class="w">
</span><span class="n">git</span><span class="w"> </span><span class="nx">config</span><span class="w"> </span><span class="nt">--global</span><span class="w"> </span><span class="nt">--add</span><span class="w"> </span><span class="nx">http.https://</span><span class="nv">$userName</span><span class="err">@</span><span class="nx">dev.azure.com/</span><span class="nv">$organization</span><span class="nx">/</span><span class="nv">$project</span><span class="nx">/_git/</span><span class="nv">$repoName</span><span class="o">.</span><span class="nf">extraHeader</span><span class="w"> </span><span class="s2">"AUTHORIZATION: Basic </span><span class="nv">$B64Pat</span><span class="s2">"</span><span class="w">
</span><span class="p">}</span><span class="w">
</span>Note that this is specific for the repository you are using.
Solution (project based)
If you want to skip configuring this for every repo, you can also leave the repo name off this setting like the example below:
<span class="w"> </span><span class="c"># store the extra header for git to use</span><span class="w">
</span><span class="n">git</span><span class="w"> </span><span class="nx">config</span><span class="w"> </span><span class="nt">--global</span><span class="w"> </span><span class="nt">--add</span><span class="w"> </span><span class="nx">http.https://</span><span class="nv">$userName</span><span class="err">@</span><span class="nx">dev.azure.com/</span><span class="nv">$organization</span><span class="nx">/</span><span class="nv">$project</span><span class="nx">/_git/.extraHeader</span><span class="w"> </span><span class="s2">"AUTHORIZATION: Basic </span><span class="nv">$B64Pat</span><span class="s2">"</span><span class="w">
</span>Note that this is specific for the project you are using.
Solution (organization based)
If you want to skip configuring this for every repo, you can also leave the repo name off this setting like the example below:
<span class="w"> </span><span class="c"># store the extra header for git to use</span><span class="w">
</span><span class="n">git</span><span class="w"> </span><span class="nx">config</span><span class="w"> </span><span class="nt">--global</span><span class="w"> </span><span class="nt">--add</span><span class="w"> </span><span class="nx">http.https://</span><span class="nv">$userName</span><span class="err">@</span><span class="nx">dev.azure.com/</span><span class="nv">$organization</span><span class="nx">/_git/.extraHeader</span><span class="w"> </span><span class="s2">"AUTHORIZATION: Basic </span><span class="nv">$B64Pat</span><span class="s2">"</span><span class="w">
</span>Note that this is specific for the organization you are using.
by Rob Bos
Rob has a strong focus on ALM and DevOps, automating manual tasks and helping teams deliver value to the end-user faster, using DevOps techniques. This is applied on anything Rob comes across, whether it’s an application, infrastructure, serverless or training environments. Additionally, Rob focuses on the management of production environments, including dashboarding, usage statistics for product owners and stakeholders, but also as part of the feedback loop to the developers. A lot of focus goes to GitHub and GitHub Actions, improving the security of applications and DevOps pipelines. Rob is a Trainer (Azure + GitHub), a Microsoft MVP and a LinkedIn Learning Instructor. 
