Cache server - GVFSHelper 401 Authentication error

[sam2143]

Hi
we are using the Azure Devops Server 2020.1.1 configured as a Proxy and running the GVFS Cache Maintenance Service (version 18.181.316262.1). My repo is cached to ../_fileCache/proxy/gfvc/RepoId from the main server successfully. The maintenance.log shows that the fetching was successful and the repo is ready.
However, when trying to clone with "scalar clone http://xxxx/RepoName --cache-server-url=http://proxyurl/RepoID" I get:
' gvfs-helper error: '(http:401) Not Authorized'

I am running git scalar 2.33.vfs.0.0. on the client

Here is the log file with GIT_TRACE2_PERF=1 and GIT_CURL_VERBOSE=1
GIT_TRACE2_PERF_CURL_VERBOSE_Log.txt

I would appreciate any help to solve this problem.
Best regards,
Stephan

[derrickstolee]

Your logs include this warning:

warning: ----------------- SECURITY WARNING ----------------
warning: | TLS certificate verification has been disabled! |
warning: ---------------------------------------------------
warning: HTTPS connections may not be secure. See https://aka.ms/gcmcore-tlsverify for more information.

And it links to here: https://github.com/GitCredentialManager/git-credential-manager/blob/main/docs/netconfig.md#tls-verification

Your cache server must have a self-signed certificate, which can be dangerous. However, there are details in that document about how to work around that issue. The best approach is to use a more secure certificate for your HTTPS traffic.

[sam2143]

Hi Derrick,
Thanks for the fast reply. I understand that disabling SSL verification is dangerous and should only be used for testing.
However, I would assume that using a self signed certificate and disabling SSL verification, as I did, should still allow me to authenticate with the cache server. Am I wrong here? Is a verified SSL certificate required to use the cache-server? Even if it is dangerous, can this be used with http, i.e. no SSL at all?

Best,
Stephan

[derrickstolee]

This warning is coming from your credential manager, warning of the risks. The linked document clearly states the workarounds, but that you are taking on risk by following them.

HTTP would be even worse, since your credentials would be passed across the network in plain-text for every router to see, even if they are not imitating your server.

[sam2143]

Hi Derrick,
I set up everything for https with self signed certificates. Enabled sslverify. While I do not get the ssl warnings anymore , I still get the 401 Authorization Error.

Any ideas?

ScalarCache_Https_GIT_TRACE_PERF_GIT_CURL_VERBOSE.txt

Best Stephan