Chocolatey fails while connecting to secure source in remote session

[lavahot]

What You Are Seeing?

When using a remote powershell session (with either Enter-PSSession or Invoke-Command) and connecting to a TFS-hosted nuget feed source, the call fails with "Invalid credentials specified." repeated no less than 7 times. Using chocolatey on the machine directly works fine.

What is Expected?

To successfully connect to the source

How Did You Get This To Happen? (Steps to Reproduce)

Invoke-Command -ComputerName "MyLabMachine" -ScriptBlock {choco list -dv -s='http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' -u='bob' -p=PAT}

Output Log

Full Log Output

Chocolatey v0.10.11 Chocolatey is running on Windows v 10.0.14393.0 Attempting to delete file "C:/ProgramData/chocolatey/choco.exe.old". Attempting to delete file "C:\ProgramData\chocolatey\choco.exe.old". Command line not shown - sensitive arguments may have been passed. RemovePendingPackagesTask is now ready and waiting for PreRunMessage. Sending message 'PreRunMessage' out if there are subscribers... [Pending] Removing all pending packages that should not be considered installed... The source 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' evaluated to a 'normal' source type NOTE: Hiding sensitive configuration data! Please double and triple check to be sure no sensitive data is shown, especially if copying output to a gist for review. Configuration: CommandName='list'|CacheLocation='C:\chococache'| ContainsLegacyPackageInstalls='True'| CommandExecutionTimeoutSeconds='2700'|WebRequestTimeoutSeconds='30'| Sources='http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2'| SourceType='normal'|Debug='True'|Verbose='True'|Trace='False'| Force='False'|Noop='False'|HelpRequested='False'| UnsuccessfulParsing='False'|RegularOutput='True'|QuietOutput='False'| PromptForConfirmation='True'|AcceptLicense='False'| AllowUnofficialBuild='False'|AllVersions='False'| SkipPackageInstallProvider='False'|Prerelease='False'|ForceX86='False'| OverrideArguments='False'|NotSilent='False'| ApplyPackageParametersToDependencies='False'| ApplyInstallArgumentsToDependencies='False'|IgnoreDependencies='False'| AllowMultipleVersions='False'|AllowDowngrade='False'| ForceDependencies='False'|Information.PlatformType='Windows'| Information.PlatformVersion='10.0.14393.0'| Information.PlatformName='Windows Server 2016'| Information.ChocolateyVersion='0.10.11.0'| Information.ChocolateyProductVersion='0.10.11'| Information.FullName='choco, Version=0.10.11.0, Culture=neutral, PublicKeyToken=79d02ea9cad655eb'| Information.Is64BitOperatingSystem='True'| Information.Is64BitProcess='True'|Information.IsInteractive='False'| Information.UserName='me'| Information.UserDomainName='MYDOMAIN'| Information.IsUserAdministrator='True'| Information.IsUserSystemAccount='False'| Information.IsUserRemoteDesktop='False'| Information.IsUserRemote='True'| Information.IsProcessElevated='True'| Information.IsLicensedVersion='False'|Information.LicenseType='Foss'| Features.AutoUninstaller='True'|Features.ChecksumFiles='True'| Features.AllowEmptyChecksums='False'| Features.AllowEmptyChecksumsSecure='True'| Features.FailOnAutoUninstaller='False'| Features.FailOnStandardError='False'|Features.UsePowerShellHost='True'| Features.LogEnvironmentValues='False'|Features.LogWithoutColor='False'| Features.VirusCheck='False'| Features.FailOnInvalidOrMissingLicense='False'| Features.IgnoreInvalidOptionsSwitches='True'| Features.UsePackageExitCodes='True'| Features.UseFipsCompliantChecksums='False'| Features.ShowNonElevatedWarnings='True'| Features.ShowDownloadProgress='True'| Features.StopOnFirstPackageFailure='False'| Features.UseRememberedArgumentsForUpgrades='False'| Features.IgnoreUnfoundPackagesOnUpgradeOutdated='False'| Features.RemovePackageInformationOnUninstall='False'| Features.ScriptsCheckLastExitCode='False'| ListCommand.LocalOnly='False'| ListCommand.IdOnly='False'|ListCommand.IncludeRegistryPrograms='False'| ListCommand.PageSize='25'|ListCommand.Exact='False'| ListCommand.ByIdOnly='False'|ListCommand.ByTagOnly='False'| ListCommand.IdStartsWith='False'|ListCommand.OrderByPopularity='False'| ListCommand.ApprovedOnly='False'| ListCommand.DownloadCacheAvailable='False'| ListCommand.NotBroken='False'| ListCommand.IncludeVersionOverrides='False'| UpgradeCommand.FailOnUnfound='False'| UpgradeCommand.FailOnNotInstalled='False'| UpgradeCommand.NotifyOnlyAvailableUpgrades='False'| UpgradeCommand.ExcludePrerelease='False'| NewCommand.AutomaticPackage='False'| NewCommand.UseOriginalTemplate='False'|SourceCommand.Command='unknown'| SourceCommand.Username='bob'|SourceCommand.Priority='0'| SourceCommand.BypassProxy='False'| SourceCommand.AllowSelfService='False'| SourceCommand.VisibleToAdminsOnly='False'| FeatureCommand.Command='unknown'|ConfigCommand.Command='unknown'| PinCommand.Command='unknown'|OutdatedCommand.IgnorePinned='False'| Proxy.Location='http://myproxy:80'| Proxy.BypassList='localhost,127.0.0.1,*.mydomain,mytfs,mytfs.mydomain'| Proxy.BypassOnLocal='True'| _ Chocolatey:ChocolateyListCommand - Normal Run Mode _ Searching for package information Running list with the following filter = '' --- Start of List --- Using proxy server 'http://myproxy:80'. Proxy has a bypass list of 'localhost,127.0.0.1,*.mydomain,mytfs,mytfs.mydomain'. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Invalid credentials specified. Attempting to gather credentials for 'http://mytfs.mydomain/tfs/mycollection/_packaging/myfeed/nuget/v2' Using passed in credentials Sending message 'PostRunMessage' out if there are subscribers... The remote server returned an error: (401) Unauthorized.

[lavahot]

Wait... Double-Hop?

[bcurran3]

I don't think this issue has anything at all to do with Chocolatey or choco.exe.

BUT, I think this might help you: https://chocolatey.org/packages/bettertls-psmodule

[peterbarendse]

Same issue. @bcurran3 his proposal didn't fixed the issue. Azure Devops Server (local): Version Dev17.M153.3 Choco version: v0.10.15

Any update on this issue?

[ferventcoder]

I believe this might be related to #1770.

[ferventcoder]

There is possibly a need for CredSSP here to get past double hop, but I think there may also be something else at play?