# Using the git module with HTTP/S creds **URL:** \ **Category:** Ansible Project\ **Created:** [September 17, 2014, 4:49pm UTC](https://forum.ansible.com/t/using-the-git-module-with-http-s-creds/16260 "2014-09-17T16:49:57Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![JCM](https://avatars.discourse-cdn.com/v4/letter/j/58f4c7/32.png) [@JCM](https://forum.ansible.com/u/JCM)\ **Post date:** [September 17, 2014, 4:49pm UTC](https://forum.ansible.com/t/using-the-git-module-with-http-s-creds/16260/1 "2014-09-17T16:49:57Z")
Hi all - I've hit a blocker when using the git module in combination with Github's token method: [https://developer.github.com/guides/managing-deploy-keys/#https-cloning-with-oauth-tokens](https://developer.github.com/guides/managing-deploy-keys/#https-cloning-with-oauth-tokens). This email also outlines an additional problem I've noticed. I'd be really grateful for any suggestions of what I'm doing wrong or if there really are problems. The place I'm trying to get to is this: \* Call Github API to create new limited-scope token \* Use Ansible to clone (\*or\* update, depending on the git module's idea of if it can update in place) using an HTTPS repo URI with this new token, passed in as an extra-var/envvar. \* Revoke token via the API # Problem 1: The only way I can see to use a passworded HTTPS URI with the git module and github is as per [https://help.github.com/articles/git-automation-with-oauth-tokens](https://help.github.com/articles/git-automation-with-oauth-tokens). i.e. "repo=https://<token>:x\-oauth\-basic@f.q.d.n/path/to/remote/repo.git". Unfortunately, Ansible (although it may just be git itself, behind the scenes) appears to freeze the username/password combination into the repo's .git/config file, as part of the URI. This means that, after the first deployment, the next git-update/-pull/-fetch operation fails due to the initial token now being revoked. # Problem 2: The git module must know that the URI contains a username and password, because it blanks out (\*only\*) the password in its logged output. However, using this with github method outlined above means that it blanks out the fixed string "x-oauth-basic" and not the token. Of course this is a result of Github's implementation choices, but they're a big enough target for use by the git module that I believe Ansible should deal with their choice. Hopefully someone can tell me where I'm going wrong. No, using SSH keys isn't an option! Many thanks, Jonathan ---
**Author:** ![Toshio\_Kuratomi](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Toshio\_Kuratomi](https://forum.ansible.com/u/Toshio_Kuratomi)\ **Post date:** [September 17, 2014, 6:55pm UTC](https://forum.ansible.com/t/using-the-git-module-with-http-s-creds/16260/2 "2014-09-17T18:55:22Z")
> Hi all - > > I've hit a blocker when using the git module in combination with > Github's token method: > > [https://developer.github.com/guides/managing-deploy-keys/#https-cloning-with-oauth-tokens](https://developer.github.com/guides/managing-deploy-keys/#https-cloning-with-oauth-tokens) > . > This email also outlines an additional problem I've noticed. I'd be > really grateful for any suggestions of what I'm doing wrong or if > there really are problems. > > The place I'm trying to get to is this: > > \* Call Github API to create new limited-scope token > \* Use Ansible to clone (\*or\* update, depending on the git module's > idea of if it can update in place) using an HTTPS repo URI with this > new token, passed in as an extra-var/envvar. > \* Revoke token via the API > > # Problem 1: > The only way I can see to use a passworded HTTPS URI with the git > module and github is as per > [https://help.github.com/articles/git-automation-with-oauth-tokens](https://help.github.com/articles/git-automation-with-oauth-tokens). > > i.e. "repo=https://<token>:x\-oauth\-basic@f.q.d.n/path/to/remote/repo.git". > > Unfortunately, Ansible (although it may just be git itself, behind the > scenes) appears to freeze the username/password combination into the > repo's .git/config file, as part of the URI. > > This means that, after the first deployment, the next > git-update/-pull/-fetch operation fails due to the initial token now > being revoked. > > I can't think of anything in the current git module that would help with this directly. You could workaround it by including a task to edit the git config after this initial checkout. > # Problem 2: > The git module must know that the URI contains a username and > password, because it blanks out (\*only\*) the password in its logged > output. However, using this with github method outlined above means > that it blanks out the fixed string "x-oauth-basic" and not the token. > Of course this is a result of Github's implementation choices, but > they're a big enough target for use by the git module that I believe > Ansible should deal with their choice. The password blanking that ansible does is best effort and somewhat limited because there's just so many variations on how sensitive information can be arbitrarily formatted.. In any non-standard case, it's probably better to explicitly specify the no\_log attribute to your task: [http://docs.ansible.com/faq.html#how-do-i-keep-secret-data-in-my-playbook](http://docs.ansible.com/faq.html#how-do-i-keep-secret-data-in-my-playbook) -Toshio ---
**Author:** ![kesten\_broughton1](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@kesten\_broughton1](https://forum.ansible.com/u/kesten_broughton1)\ **Post date:** [January 31, 2016, 8:17pm UTC](https://forum.ansible.com/t/using-the-git-module-with-http-s-creds/16260/3 "2016-01-31T20:17:19Z")
“Ansible (although it may just be git itself, behind the scenes) appears to freeze the username/password combination into the repo’s .git/config file” Old thread, but it appears that this is a git feature, not an ansible thing. [https://github.com/blog/1270-easier-builds-and-deployments-using-git-over-https-and-oauth](https://github.com/blog/1270-easier-builds-and-deployments-using-git-over-https-and-oauth) See the notes at the bottom for pulling without storing auth-token on disk. Possibly a better way would be using hashicorp’s vault project.