How GitHub git CLI authenticate using SSO without Browser

I am using "git" CLI on a machine behind a proxy.

In the .gitconfig file I have configured the http and proxy section parameters, so all fine in the sense that I can access GitHub from command line.

However since the GitHub Organization has SAML SSO (+ 2FA) enabled, during e.g. a "git clone" command the process asks to sign in with Browser because of the SSO. However I need to proceed without the possibility to use a Browser (because the Browser has no proxy configuration..). Is there a mechanism to achieve that?

thanks

Solution

The headless auth can be done with --with-token

From GitHub's gh auth login:

# authenticate against github.com by reading the token from a file
$ gh auth login --with-token < mytoken.txt

If you're using fine grain tokens this should just work.

If you have a classic token you'll need to authorize it. This is explained in the GitHub's official Authorizing a personal access token for use with SAML single sign-on.

It's a good idea to clear with the person responsible for security that there will be a setup where 2FA is not used when the policy is to use 2FA. You may, for example, be required to use a token linked to a dedicated service account, not to your personal account.