Edit

Kerberos authentication

  • Article

Azure DevOps Server 2022 - Azure DevOps Server 2019

If you use Azure DevOps to manage your Git repository, Git may be using the Kerberos protocol to authenticate. (This doesn't apply to Azure DevOps Services, which uses a different form of authentication.) LFS doesn't support Kerberos, so you can get errors which say "Your user name must be of the form DOMAIN\user". As of Git LFS version 2.4.0, NTLM authentication with SSPI has been added. You'll no longer receive these errors and authentication will work without extra configuration.

We highly recommend you upgrade to Git LFS version 2.4.0 or later, where no extra configuration is necessary.

If you can't upgrade to 2.4.0, you can remove the Kerberos credential and let Git pick up a new NTLM credential by using the following workaround.

Note

Credentials sent via HTTP will be passed in clear text. Ensure your instance of TFS is configured for HTTPS, and do not use HTTP with Git-LFS.

  1. Open the Windows Credential Manager. On Windows 10, you can press Start and then type "Credential Manager".

    Open Credential Manager

  2. Choose Windows Credentials.

    Choose Windows Credentials

  3. Find your TFS URL in the credential list.

  4. Choose Remove.

    Choose Remove

  5. Return to your Git client (Visual Studio or the command line) and push your changes. When prompted for credentials, be sure to enter them in the form DOMAIN\username.