Why do I get sporadic Git authentication errors when multiple users share machines?

I have a large pool of Windows machines (and corresponding MATLAB installations), each of which will be used by many different people. Each of these people store their code in private GitLab repositories, and use the Git integration within MATLAB to push and pull from these repositories.

However, they often (but not always) receive authentication errors from GitLab, before they are even prompted to log in. The error is shown as a pop-up with the following text:

request failed with status code: 403
(Error code = -1, Error class = 34)

Why are these happening? And how can I prevent them?

Answer 1

[MathWorks Support Team]

Why are the errors happening?

The errors are occurring because, by default, Git will cache credentials between login attempts. The first login on a given machine will ask for and save the user's credentials, and all future login attempts will re-use the saved credentials. If these future login attempts are made by the same user, then the credentials are correct and everything works with no errors. However, if a different user starts using the same machine, Git will re-use the first user's login (without prompting for new ones) and cause the authentication error shown.

Note that this issue is not specific to GitLab - any remote repository (hosted on GitHub, GitLab, etc.) that requires authentication will cause the same errors.

Solution #1:

A one-off solution to avoid the errors is to clear Git's cached credentials. This way, the next interaction with GitLab will prompt the user for their login, and this new login will be used automatically in the future. This speeds up future logins (users will often not have to re-input their credentials), but has to be done for every change of users.

On Windows, Git stores its credentials in the Windows Credential Manager. To clear Git's credential cache you need to follow these steps:

1) Open Credential Manager, as described here:

https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0#:~:text=Credential%20Manager%20lets%20you%20view,select%20Credential%20Manager%20Control%20panel

2) Click on 'Windows Credentials' (as opposed to the default 'Web Credentials')

3) Remove any entries relating to "git"

Solution #2:

A more permanent solution is to configure Git so that it will never cache credentials. This means that, in the future, Git will always prompt the user for a login without using any cached credentials. This slows down any interactions with the remote repository, but means that action is not required for future changes of user.

This can be achieved on any OS with the following steps:

1) Check the current location where git is storing its credentials by running the following command in the MATLAB Console:

>> !git config --get credential.helper

Running this on a fresh MATLAB R2022b installation on my Windows machine outputs "manager", which means that git will store login credentials in the Windows Credential Manager.

2) Tell Git to never cache login credentials by running the following command in the MATLAB Console:

>> !git config --global credential.helper ""

3) Check that value has changed by re-running the first command, again in the MATLAB Console:

>> !git config --get credential.helper

This time, it should not print anything, which indicates that no credential helpers are in use. Git should now always ask for a login when authenticating with GitLab.

More information about Git's credential configuration, including other possible values, can be found in this documentation page:

https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage