GetResponseWithRedirects only adds credentials to cache for matching schemes

The previous implementation of `ManagedHttpSmartSubtransportStream.GetResponseWithRedirects` was not checking that the scheme matched the provided credentials before adding to the credential cache (instead defaulting to the scheme of the first value in the WWW-Authenticate header).

That could cause issues in some cases where the first challenge contained an unsupported scheme (such as Bearer). In this case, the old implemenation would add the credentials to the cache with Bearer scheme - regardless of the credential type - and all additional (potentially valid) schemes in the header would be discarded.

Credentials are now added to the cache for every supported scheme that matches the given credential type.

The new implementation copies the one used in the libgit2 library: Default credentials are used for the Negotiate scheme, username/password credentials are used for the NTLM and Basic schemes, and all others are ignored.

The error in the current implementation can be reproduced when attempting to connect to a repository in an Azure AD-backed Azure DevOps organisation.

Author: Dylan Lerch

LibGit2Sharp/Core/ManagedHttpSmartSubtransport.cs

@@ -47,6 +47,9 @@ private class ManagedHttpSmartSubtransportStream : SmartSubtransportStream
         {
             private static int MAX_REDIRECTS = 7;
 
+            private static readonly string[] DEFAULT_CREDENTIAL_SUPPORTED_SCHEMES = { "Negotiate" };
+            private static readonly string[] USERNAME_PASSWORD_CREDENTIAL_SUPPORTED_SCHEMES = { "NTLM", "Basic" };
+
 #if NETCOREAPP
             private static readonly SocketsHttpHandler httpHandler;
 #else
@@ -189,20 +192,14 @@ private HttpResponseMessage GetResponseWithRedirects()
                                 throw new InvalidOperationException("authentication cancelled");
                             }
 
-                            var scheme = response.Headers.WwwAuthenticate.First().Scheme;
-
-                            if (cred is DefaultCredentials)
+                            foreach (var authenticationHeader in response.Headers.WwwAuthenticate)
                             {
-                                lock (credentialCache)
+                                if (CredentialsAreValidForScheme(cred, authenticationHeader.Scheme, out var networkCredential))
                                 {
-                                    credentialCache.Add(url, scheme, CredentialCache.DefaultNetworkCredentials);
-                                }
-                            }
-                            else if (cred is UsernamePasswordCredentials userpass)
-                            {
-                                lock (credentialCache)
-                                {
-                                    credentialCache.Add(url, scheme, new NetworkCredential(userpass.Username, userpass.Password));
+                                    lock (credentialCache)
+                                    {
+                                        credentialCache.Add(url, authenticationHeader.Scheme, networkCredential);
+                                    }
                                 }
                             }
 
@@ -221,6 +218,23 @@ private HttpResponseMessage GetResponseWithRedirects()
                 throw new Exception("too many redirects or authentication replays");
             }
 
+            bool CredentialsAreValidForScheme(Credentials credentials, string scheme, out NetworkCredential networkCredential)
+            {
+                if (credentials is DefaultCredentials && DEFAULT_CREDENTIAL_SUPPORTED_SCHEMES.Contains(scheme, StringComparer.InvariantCultureIgnoreCase))
+                {
+                    networkCredential = CredentialCache.DefaultNetworkCredentials;
+                    return true;
+                }
+                else if (credentials is UsernamePasswordCredentials userpass && USERNAME_PASSWORD_CREDENTIAL_SUPPORTED_SCHEMES.Contains(scheme, StringComparer.InvariantCultureIgnoreCase))
+                {
+                    networkCredential = new NetworkCredential(userpass.Username, userpass.Password);
+                    return true;
+                }
+
+                networkCredential = null;
+                return false;
+            }
+
             public override int Read(Stream dataStream, long length, out long readTotal)
             {
                 byte[] buffer = new byte[4096];