Authenticating feeds in Visual Studio with NuGet credential providers

The NuGet Visual Studio Extension 3.6+ supports credential providers, which enable NuGet to work with authenticated feeds. After you install a NuGet credential provider for Visual Studio, the NuGet Visual Studio extension will automatically acquire and refresh credentials for authenticated feeds as necessary.

A sample implementation can be found in the VsCredentialProvider sample.

Within Visual Studio, NuGet uses an internal VsCredentialProviderImporter which also scans for plug-in credential providers. These plug-in credential providers must be discoverable as a MEF Export of type IVsCredentialProvider.

Starting with 4.8+ NuGet in Visual Studio supports the new cross platform authentication plugins as well, but they are not the recommended approach for performance reasons.

Creating a NuGet credential provider for Visual Studio

The NuGet Visual Studio Extension 3.6+ implements an internal CredentialService that is used to acquire credentials. The CredentialService has a list of built-in and plug-in credential providers. Each provider is tried sequentially until credentials are acquired.

During credential acquisition, the credential service will try credential providers in the following order, stopping as soon as credentials are acquired:

1. Credentials will be fetched from NuGet configuration files (using the built-in SettingsCredentialProvider).
2. If the package source is on Visual Studio Team Services, the VisualStudioAccountProvider will be used.
3. All other plug-in Visual Studio credential providers will be tried sequentially.
4. Try to use all NuGet cross platform credential providers sequentially.
5. If no credentials have been acquired yet, the user will be prompted for credentials using a standard basic authentication dialog.

Implementing IVsCredentialProvider.GetCredentialsAsync

To create a NuGet credential provider for Visual Studio, create a Visual Studio Extension that exposes a public MEF Export implementing the IVsCredentialProvider type, and adheres to the principles outlined below.

public interface IVsCredentialProvider
{
    Task<ICredentials> GetCredentialsAsync(
        Uri uri,
        IWebProxy proxy,
        bool isProxyRequest,
        bool isRetry,
        bool nonInteractive,
        CancellationToken cancellationToken);
}

A sample implementation can be found in the VsCredentialProvider sample.

Each NuGet credential provider for Visual Studio must:

1. Determine whether it can provide credentials for the targeted URI before initiating credential acquisition. If the provider cannot supply credentials for the targeted source, then it should return null.
2. If the provider does handle requests for the targeted URI, but cannot supply credentials, an exception should be thrown.

A custom NuGet credential provider for Visual Studio must implement the IVsCredentialProvider interface available in the NuGet.VisualStudio package.

GetCredentialAsync

Return value: A credentials object implementing the System.Net.ICredentials interface.