如何使用libgit2连接TFS Server？含git-credential-manager.exe实现方案

Alright, let's break this down into two clear, actionable parts for you:

TFS (now often referred to as Azure DevOps Server) hosts Git repositories that work with standard Git protocols, so libgit2 can connect directly—you just need to handle authentication properly. Here's how:

1. Prepare your libgit2 build #

First, make sure your libgit2 binary is compiled with support for the authentication method your TFS uses:

• For NTLM/Kerberos domain authentication (common in Windows environments), enable the USE_SSPI or USE_NTLM build flags (names may vary slightly across libgit2 versions).
• For Personal Access Tokens (PAT) (the recommended passwordless method), basic HTTP auth support (enabled by default in most builds) is sufficient.

2. Implement an authentication callback #

libgit2 relies on callback functions to fetch credentials when needed. Here are code examples for the two most common scenarios (using C):

Scenario A: Authenticate with a PAT #

For PATs, you can use any username (like your email or even git), and the PAT itself as the password:

int cred_acquire_cb(git_cred **out, const char *url, const char *username_from_url, unsigned int allowed_types, void *payload) {
    // Replace with your own email/PAT
    return git_cred_userpass_plaintext_new(out, "your-work-email@company.com", "your-tfs-pat-token-here");
}

// Use the callback when cloning the repo
git_clone_options opts = GIT_CLONE_OPTIONS_INIT;
opts.fetch_opts.callbacks.credentials = cred_acquire_cb;

git_repository *repo = NULL;
int error = git_clone(&repo, "https://tfs-server:8080/tfs/Collection/_git/YourRepoName", "./local-repo", &opts);

Scenario B: Authenticate with Windows domain credentials (NTLM) #

If your machine is joined to the domain, libgit2 can use SSPI to automatically fetch your Windows credentials:

int cred_acquire_cb(git_cred **out, const char *url, const char *username_from_url, unsigned int allowed_types, void *payload) {
    // Try SSPI first to auto-use Windows domain credentials
    if (allowed_types & GIT_CREDTYPE_SSPI) {
        return git_cred_sspi_new(out, NULL);
    }
    // Fallback to manual username/password if needed
    return git_cred_userpass_plaintext_new(out, "DOMAIN\\your-username", "your-domain-password");
}

// Attach the callback to your clone/fetch operation
git_clone_options opts = GIT_CLONE_OPTIONS_INIT;
opts.fetch_opts.callbacks.credentials = cred_acquire_cb;

Git Credential Manager (GCM) handles all the heavy lifting for credential storage and authentication (including PATs, NTLM, and OAuth) and integrates seamlessly with libgit2. Here's how to set it up:

1. Ensure GCM is installed and configured #

If you have Git for Windows installed, GCM is usually included and set as the default credential helper. If not, install it separately, then run this command to configure it globally:

git config --global credential.helper manager

2. Use GCM with libgit2 #

You have two options to make libgit2 use GCM:

Option A: Leverage global Git config #

If you've set GCM as the global credential helper via git config, libgit2 will automatically pick up this setting. No extra code is needed—just run your standard libgit2 operations:

git_repository *repo = NULL;
// libgit2 will call GCM automatically when credentials are needed
int error = git_clone(&repo, "https://tfs-server:8080/tfs/Collection/_git/YourRepoName", "./local-repo", NULL);

Option B: Manually configure in code #

If you need to override the global config or set GCM for a specific repository, configure it directly in your code:

git_repository *repo = NULL;
git_clone_options opts = GIT_CLONE_OPTIONS_INIT;

// Create a config and set the credential helper to GCM
git_config *config;
git_config_new(&config);
git_config_set_string(config, "credential.helper", "manager");
opts.fetch_opts.callbacks.payload = config;
opts.fetch_opts.callbacks.credentials = git_credential_manager_acquire;

// Clone the repo with the custom config
int error = git_clone(&repo, "https://tfs-server:8080/tfs/Collection/_git/YourRepoName", "./local-repo", &opts);

// Clean up the config when done
git_config_free(config);

3. Key notes #

• On first connection, GCM will pop up a login window (or prompt in the terminal) to collect your credentials. It will store them in your system's credential manager for future use.
• If you prefer using a PAT, GCM supports storing it too—just select the PAT option when prompted to log in.

内容的提问来源于stack exchange，提问作者 alpha