Personal Access Tokens doesn't work for Registry or Git/HTTP access

Summary

Personal Access Tokens doesn't seem to work for Registry access or Git/HTTP with Gitlab 8.15.2, Docker 1.12, Git 1.8.3

Steps to reproduce

Login with user password is ok:

# docker login -u registrytest -p [USER PASSWORD] registry.lab
Login Succeeded

# git push
Username for 'http://gitlab-ci.lab': registrytest
Password for 'http://registrytest@gitlab-ci.lab': [USER PASSWORD]
Everything up-to-date

But with token (no expiration date, no scope), tried with LDAP and local users:

# docker login -u registrytest -p [PERSONAL ACCESS TOKEN] registry.lab
Error response from daemon: Get http://registry.lab/v2/: unauthorized: HTTP Basic: Access denied

# git push
Username for 'http://gitlab-ci.lab': registrytest
Password for 'http://registrytest@gitlab-ci.lab': [PERSONAL ACCESS TOKEN]
fatal: Authentication failed for 'http://gitlab-ci.lab/myuser/ci-test.git/'

Expected behavior

Allow scripted login with personal access token when using 2FA accounts.

Actual behavior

User password works (2FA disabled) but personal access tokens don't (2FA enabled or not).

Relevant logs and/or screenshots

From /var/log/gitlab/gitlab-rails/production.log:

Docker login with user password:

Started GET "/jwt/auth?account=registrytest&service=container_registry" for 192.168.5.30 at 2017-01-03 11:04:04 +0000
Processing by JwtController#auth as HTML
  Parameters: {"account"=>"registrytest", "service"=>"container_registry"}
Completed 200 OK in 166ms (Views: 0.3ms | ActiveRecord: 3.2ms)

With token:

Started GET "/jwt/auth?account=registrytest&client_id=docker&offline_token=true&service=container_registry" for 192.168.5.76 at 2017-01-03 11:04:37 +0000
Processing by JwtController#auth as HTML
  Parameters: {"account"=>"registrytest", "client_id"=>"docker", "offline_token"=>"true", "service"=>"container_registry"}
Filter chain halted as :authenticate_project_or_user rendered or redirected
Completed 401 Unauthorized in 141ms (Views: 0.3ms | ActiveRecord: 3.7ms)

Git login with user password:

Started GET "/myuser/ci-test.git/info/refs?service=git-receive-pack" for 192.168.5.30 at 2017-01-03 10:58:38 +0000
Processing by Projects::GitHttpController#info_refs as */*
  Parameters: {"service"=>"git-receive-pack", "namespace_id"=>"myuser", "project_id"=>"ci-test.git"}
Filter chain halted as :authenticate_user rendered or redirected
Completed 401 Unauthorized in 28ms (Views: 0.3ms | ActiveRecord: 2.8ms)
Started GET "/myuser/ci-test.git/info/refs?service=git-receive-pack" for 192.168.5.30 at 2017-01-03 10:58:38 +0000
Processing by Projects::GitHttpController#info_refs as */*
  Parameters: {"service"=>"git-receive-pack", "namespace_id"=>"myuser", "project_id"=>"ci-test.git"}
Completed 200 OK in 151ms (Views: 0.2ms | ActiveRecord: 5.3ms)

With token:

Started GET "/myuser/ci-test.git/info/refs?service=git-receive-pack" for 192.168.5.30 at 2017-01-03 11:00:27 +0000
Processing by Projects::GitHttpController#info_refs as */*
  Parameters: {"service"=>"git-receive-pack", "namespace_id"=>"myuser", "project_id"=>"ci-test.git"}
Filter chain halted as :authenticate_user rendered or redirected
Completed 401 Unauthorized in 27ms (Views: 0.3ms | ActiveRecord: 2.7ms)
Started GET "/myuser/ci-test.git/info/refs?service=git-receive-pack" for 192.168.5.30 at 2017-01-03 11:00:31 +0000
Processing by Projects::GitHttpController#info_refs as */*
  Parameters: {"service"=>"git-receive-pack", "namespace_id"=>"myuser", "project_id"=>"ci-test.git"}
Filter chain halted as :authenticate_user rendered or redirected
Completed 401 Unauthorized in 25ms (Views: 0.3ms | ActiveRecord: 2.4ms)
Started GET "/myuser/ci-test.git/info/refs?service=git-receive-pack" for 192.168.5.30 at 2017-01-03 11:00:31 +0000
Processing by Projects::GitHttpController#info_refs as */*
  Parameters: {"service"=>"git-receive-pack", "namespace_id"=>"myuser", "project_id"=>"ci-test.git"}
Filter chain halted as :authenticate_user rendered or redirected
Completed 401 Unauthorized in 139ms (Views: 0.3ms | ActiveRecord: 4.0ms)

Results of GitLab application Check

Checking GitLab Shell ...

GitLab Shell version >= 4.1.1 ? ... OK (4.1.1)
Repo base directory exists?
default... yes
Repo storage directories are symlinks?
default... no
Repo paths owned by git:git?
default... no
  User id for git: 994. Groupd id for git: 991
  Try fixing it:
  sudo chown -R git:git /var/opt/gitlab/git-data/repositories
  For more information see:
  doc/install/installation.md in section "GitLab Shell"
  Please fix the error above and rerun the checks.
Repo paths access is drwxrws---?
default... yes
hooks directories in repos are links: ...
2/1 ... ok
3/2 ... ok
4/4 ... ok
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Check GitLab API access: OK
Access to /var/opt/gitlab/.ssh/authorized_keys: OK
Send ping to redis server: OK
gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Sidekiq ...

Running? ... yes
Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished

Checking Reply by email ...

Reply by email is disabled in config/gitlab.yml

Checking Reply by email ... Finished

Checking LDAP ...

Server: ldapmain
LDAP authentication... Success
LDAP users with access to your GitLab server (only showing the first 100 results)

  [...]

Checking LDAP ... Finished

Checking GitLab ...

Git configured with autocrlf=input? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config outdated? ... no
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory setup correctly? ... skipped (no tmp uploads folder yet)
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
projects have namespace: ...
2/1 ... yes
3/2 ... yes
4/4 ... yes
Redis version >= 2.8.0? ... yes
Ruby version >= 2.1.0 ? ... yes (2.3.3)
Your git bin path is "/opt/gitlab/embedded/bin/git"
Git version >= 2.7.3 ? ... yes (2.8.4)
Active users: 5

Checking GitLab ... Finished

Results of GitLab environment info

System information
System:
Current User:   git
Using RVM:      no
Ruby Version:   2.3.3p222
Gem Version:    2.6.6
Bundler Version:1.13.7
Rake Version:   10.5.0
Sidekiq Version:4.2.7

GitLab information
Version:        8.15.2
Revision:       790035f
Directory:      /opt/gitlab/embedded/service/gitlab-rails
DB Adapter:     postgresql
URL:            http://gitlab-ci.lab
HTTP Clone URL: http://gitlab-ci.lab/some-group/some-project.git
SSH Clone URL:  git@gitlab-ci.lab:some-group/some-project.git
Using LDAP:     yes
Using Omniauth: no

GitLab Shell
Version:        4.1.1
Repository storage paths:
- default:      /var/opt/gitlab/git-data/repositories
Hooks:          /opt/gitlab/embedded/service/gitlab-shell/hooks/
Git:            /opt/gitlab/embedded/bin/git