Credential Manager integration just like Git Bash and Git Credential Manager

[fischerdouglas]

Description of the new feature/enhancement

The ideia is to copy the resources and concepts the is used on https://github.com/microsoft/Git-Credential-Manager-for-Windows and apply it on windows terminal...

If any credential is requested, it gets in action. Looks into a base if it is already there... That it supports "user+password" authentication, or public/private keys authentication also. Store/replace new credentials if needed...

(P.S.: Git-CredentialManager AskPass wold be nice.

I'm not a programmer... But I think this may fit.

Git bash uses it. If I'm not wrong, in some way, Visual Studio Code also already uses it...

I also know that Windows Terminal has no intention to deal with Password Managers like LastPass or similar... But I think it could be different than that. Mostly on the concerns of risks of using someone else code.

Proposed technical implementation details (optional)

I don't have any details... But if I say "Please" many time would help?

Connect to already created profiles that connect to ssh or telnet without prompting-me passwords... Geting it from a credential databases Windows Credential Manager(equivalent to MasOX KeyChain), or Git-CredentialManager.

[fischerdouglas]

Please, Don't let it just to Version 2.0 as proposed in Roadmap...

https://github.com/microsoft/terminal/blob/master/doc/terminal-v2-roadmap.md

[KalleOlaviNiemitalo]

The Azure Cloud Shell feature in Windows Terminal already has Credential Manager integration.

Suppose a user has Windows Terminal displaying an application such as PowerShell 7, which then asks for credentials. Nowadays, it looks like this:

PS C:\> $credential = Get-Credential

PowerShell credential request
Enter your credentials.
User: myself
Password for user myself: ********

If I understand correctly, you'd like Windows Terminal to detect this credential request and let the user select a previously saved user name and password. Presumably, this should also work if there is an SSH connection between Windows Terminal and the application; otherwise, the application could access the local Credential Manager and pop up a dialog box on its own, so there would be no benefit in having Windows Terminal do that.

There are a few difficulties:

• I don't think there is currently a standard way for an application to tell the terminal that it wants credentials. Thus, Windows Terminal would have to guess based on what text the application is outputting and whether there is a delay afterwards. Such text can depend on the user's language settings. It might be possible to define a more formal signaling mechanism, e.g. using the ECMA-48 PRIVACY MESSAGE control function, but that would then have to be implemented in each application.
• Windows Terminal cannot be sure which program is asking for credentials, especially from behind an SSH connection. So, the feature might make it too easy for users to reveal their passwords to unintended applications.
• Even if the user's intended application prompts for credentials and Windows Terminal correctly detects that, the credentials might be read by some other application, e.g. if the original one is killed. This could lead to credentials being saved in shell history files or such.

[DHowett]

@KalleOlaviNiemitalo is totally correct here. I really appreciate your excitement, and your suggestion, but this isn't something Terminal is going to do. It's too dangerous to put your terminal emulator in control of your passwords especially when there is no way to validate the destination or recipient of your credentials over a text-mode-only connection.

I'm going to close this one for now, but please feel free to continue the discussion.

[KalleOlaviNiemitalo]

OpenSSH is able to forward requests to an authentication agent, but SSH Agent Protocol supports only keys, not plaintext passwords.

It might be technically (even if not financially) possible to define a similar protocol for user names and passwords, then change Windows Terminal, SSH clients, SSH servers, and applications to use it. This would presumably involve another environment variable pointing to an AF_UNIX socket. The SSH server would be able to augment the password request with the process ID and user and group IDs of the application, from SCM_CREDENTIALS. The SSH client would be able to augment the password request with the name of the remote server and how the server was authenticated. Windows Terminal would be able to verify that the request came via the SSH client process, and to display the information added by the SSH client and server. However, this information would still not make it easy for the user to determine whether the request is trustworthy.

OpenSSH is also able to delegate GSSAPI credentials but I don't really understand how that works or whether it can be used for this purpose.