git-ecosystem/git-credential-manager · error · ArgumentOutOfRangeException

Unexpected AuthenticationModes returned from prompt

Error message

Unexpected AuthenticationModes returned from prompt

What it means

After the prompt, GetRefreshedCredentials switches on the returned AuthenticationMode; only Basic and OAuth are handled. Any other mode reaching this switch indicates an internal contract violation between the authentication component and the host provider, so ArgumentOutOfRangeException 'Unexpected AuthenticationModes returned from prompt' is thrown.

Solutions

1. Use official, matching GCM binaries (reinstall) so provider and auth component agree on supported modes
2. Only pass AuthenticationModes.Basic | AuthenticationModes.OAuth in the modes set for Bitbucket.org
3. Remove custom patches/plugins altering the prompt result

Example fix

// before
var result = await auth.GetCredentialsAsync(uri, null, AuthenticationModes.Gcm);
// after
var result = await auth.GetCredentialsAsync(uri, null, AuthenticationModes.Basic | AuthenticationModes.OAuth);

if ((modes & ~(AuthenticationModes.Basic | AuthenticationModes.OAuth)) != 0)
    throw new InvalidOperationException("Only Basic/OAuth supported for Bitbucket prompts");

bool IsPromptableMode(AuthenticationModes m) => m is AuthenticationModes.Basic or AuthenticationModes.OAuth;

try { var cred = await provider.GetCredentialAsync(input); }
catch (ArgumentOutOfRangeException ex) { trace.Error(ex); return null; }

When it happens

Trigger: GetCredentialsAsync returns a CredentialsPromptResult whose AuthenticationMode is neither Basic nor OAuth nor None (e.g. Browser or combined flags) — typically from a mismatched/modified auth component or plugin.

Common situations: Custom forks or patched GCM builds adding modes; version skew between the provider and BitbucketAuthentication assemblies; manual construction of CredentialsPromptResult in tests/tools.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unknown authentication mode
• Unexpected interaction mode.
• At least one AuthenticationModes must be supplied
• Unsupported workload federation scenario.
• No protocol name mapping is defined for the given…

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/46665c10a2a40c01. Report an issue: GitHub.

Appendix: source

Thrown at src/Atlassian.Bitbucket/BitbucketHostProvider.cs:187

                if (result is null || result.AuthenticationMode == AuthenticationModes.None)
                {
                    var message = "User cancelled credential prompt";
                    _context.Trace.WriteLine(message);
                    throw new Trace2Exception(_context.Trace2, message);
                }

                switch (result.AuthenticationMode)
                {
                    case AuthenticationModes.Basic:
                        // Return the valid credential
                        return result.Credential;

                    case AuthenticationModes.OAuth:
                        // If the user wants to use OAuth fall through to interactive auth
                        break;

                    default:
                        throw new ArgumentOutOfRangeException(
                            $"Unexpected {nameof(AuthenticationModes)} returned from prompt");
                }

                // Fall through to the start of the interactive OAuth authentication flow
            }
            else
            {
                _context.Trace.WriteLineSecrets("Found stored refresh token: {0}", new object[] { refreshToken });

                try
                {
                    return await GetOAuthCredentialsViaRefreshFlow(request, refreshToken);
                }
                catch (OAuth2Exception ex)
                {
                    var message = "Failed to refresh existing OAuth credential using refresh token";
                    _context.Trace.WriteLine(message);
                    _context.Trace.WriteException(ex);

View on GitHub (pinned to e8ce762cd0)