The scenario here is that your users are not authenticated when using git GUI clients, such as SourceTree or GitHub Desktop, to pull data from your Bitbucket repository.

There are several reasons why authentication is failing. 

Reason 1 - URL notation issues

Explanation: For NTLM or Kerberos authentication to work your git HTTP URLs should use the following "special" notation: http://:@host/repopath
The ":" in front of "@" tells git to use OS default credentials i.e. use NTLM or Kerberos when challenged.

Example:  https://MyCompany@bitbucket.mycompany.org/scm/bus/project.git becomes https://:@bitbucket.mycompany.org/scm/bus/project.git.


Reason 2 - git GUI client related issues

Several git GUI clients work immediately, but the command line git for Windows seems to have a bug on "push".

Fix: Enable support for cookies by using the following line: git config --global http.cookiefile <absolute path to cookie file>

Example: git config --global http.cookiefile C:\Users\YourCompany\git-cookies.txt


An intermediary fix: Incorrect syntax

Fix: Users need to enter their username and password into the pop-up offered by the git GUI client in the following syntax: DOMAIN\username + domain password


A general fix to restrict SSO to the web interface only

Instruct EasySSO to ignore the actual git operations by adding the following to the EasySSO "Additional Parameters" field

excludes=/scm/*


Please note that this means you will have SSO only for the web interface, but not for git GUI clients.


EasySSO articles