remote-curl: fall back to basic auth if Negotiate fails
A message that is not in the archive (sent off-list or not yet received): [email protected]
PATCH v2 1/1 remote-curl: fall back to basic auth if Negotiate fails
From: Christopher Schenk <[email protected]>
When the username and password are supplied in a url like this
https://myuser:[email protected]/myrepo.git and the server supports the negotiate authenticaten method git does not fall back to basic auth and libcurl hardly tries to authenticate with the negotiate method.
Stop using the Negotiate authentication method after the first failure because if it fails on the first try it will never succeed.
V1 of this patch somehow did not make it to the mailing list so i will try to send this patch again
---
remote-curl: fall back to basic auth if Negotiate fails
When the username and password are supplied in a url like this
https://myuser:[email protected]/myrepo.git and the server supports the negotiate authenticaten method git does not fall back to basic auth and libcurl hardly tries to authenticate with the negotiate method.
Stop using the Negotiate authentication method after the first failure because if it fails on the first try it will never succeed.
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-849%2Fchschenk%2Fkerberos-basic-fallback-v2
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-849/chschenk/kerberos-basic-fallback-v2
Pull-Request: https://github.com/gitgitgadget/git/pull/849
Range-diff vs v1:
1: 285a8a568444 ! 1: 7bfc0b431910 remote-curl: fall back to basic auth if Negotiate fails
@@ Commit message
Stop using the Negotiate authentication method after the first failure because if it fails on the first try it will never succeed.
+ V1 of this patch somehow did not make it to the mailing list so i will
+ try to send this patch again
+
## http.c ##
http.c | 8 ++++++++ 1 file changed, 8 insertions(+)
http.c +8 -0
@@ -1642,6 +1642,14 @@ static int handle_curl_result(struct slot_results *results)return HTTP_MISSING_TARGET ; else if (results->http_code == 401) {if (http_auth.username && http_auth.password) { +#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY +if (results->auth_avail &CURLAUTH_GSSNEGOTIATE ) { + http_auth_methods &= ~CURLAUTH_GSSNEGOTIATE ; + http_auth_methods &= results->auth_avail; + http_auth_methods_restricted =1 ; +return HTTP_REAUTH ; + } +#endif credential_reject (&http_auth);return HTTP_NOAUTH ; }else {
base-commit: 71ca53e8125e36efbda17293c50027d31681a41f
Signature · 1 line
gitgitgadget
PATCH v3 1/1 remote-curl: fall back to basic auth if Negotiate fails
From: Christopher Schenk <[email protected]>
When the username and password are supplied in a url like this
https://myuser:[email protected]/myrepo.git and the server supports the negotiate authenticaten method, git does not fall back to basic auth and libcurl hardly tries to authenticate with the negotiate method.
Stop using the Negotiate authentication method after the first failure because if it fails on the first try it will never succeed.
---
remote-curl: fall back to basic auth if Negotiate fails
When the username and password are supplied in a url like this
https://myuser:[email protected]/myrepo.git and the server supports the negotiate authenticaten method git does not fall back to basic auth and libcurl hardly tries to authenticate with the negotiate method.
Stop using the Negotiate authentication method after the first failure because if it fails on the first try it will never succeed.
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-849%2Fchschenk%2Fkerberos-basic-fallback-v3
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-849/chschenk/kerberos-basic-fallback-v3
Pull-Request: https://github.com/gitgitgadget/git/pull/849
Range-diff vs v2:
1: 7bfc0b431910 ! 1: 52de7fa42f88 remote-curl: fall back to basic auth if Negotiate fails
@@ Commit message
When the username and password are supplied in a url like this
https://myuser:[email protected]/myrepo.git and the server supports the
- negotiate authenticaten method git does not fall back to basic auth and
+ negotiate authenticaten method, git does not fall back to basic auth and
libcurl hardly tries to authenticate with the negotiate method.
Stop using the Negotiate authentication method after the first failure
because if it fails on the first try it will never succeed.
- V1 of this patch somehow did not make it to the mailing list so i will
- try to send this patch again
-
Signed-off-by: Christopher Schenk <[email protected]>
## http.c ##
@@ http.c: static int handle_curl_result(struct slot_results *results)
+ } else if (missing_target(results))
return HTTP_MISSING_TARGET;
else if (results->http_code == 401) {
- if (http_auth.username && http_auth.password) {
+#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY
-+ if (results->auth_avail & CURLAUTH_GSSNEGOTIATE) {
-+ http_auth_methods &= ~CURLAUTH_GSSNEGOTIATE;
-+ http_auth_methods &= results->auth_avail;
-+ http_auth_methods_restricted = 1;
-+ return HTTP_REAUTH;
-+ }
++ http_auth_methods &= ~CURLAUTH_GSSNEGOTIATE;
++ if (results->auth_avail) {
++ http_auth_methods &= results->auth_avail;
++ http_auth_methods_restricted = 1;
++ return HTTP_REAUTH;
++ }
+#endif
+ if (http_auth.username && http_auth.password) {
credential_reject(&http_auth);
return HTTP_NOAUTH;
} else {
+-#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY
+- http_auth_methods &= ~CURLAUTH_GSSNEGOTIATE;
+- if (results->auth_avail) {
+- http_auth_methods &= results->auth_avail;
+- http_auth_methods_restricted = 1;
+- }
+-#endif
+ return HTTP_REAUTH;
+ }
+ } else {http.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
http.c +8 -7
@@ -1641,17 +1641,18 @@ static int handle_curl_result(struct slot_results *results) }else if (missing_target (results))return HTTP_MISSING_TARGET ;else if (results->http_code ==401 ) { +#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY + http_auth_methods &= ~CURLAUTH_GSSNEGOTIATE ; +if (results->auth_avail) { + http_auth_methods &= results->auth_avail; + http_auth_methods_restricted =1 ; +return HTTP_REAUTH ; + } +#endif if (http_auth.username && http_auth.password) {credential_reject (&http_auth);return HTTP_NOAUTH ; }else { -#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY - http_auth_methods &= ~CURLAUTH_GSSNEGOTIATE ; -if (results->auth_avail) { - http_auth_methods &= results->auth_avail; - http_auth_methods_restricted =1 ; - } -#endif return HTTP_REAUTH ; } }else {
base-commit: 71ca53e8125e36efbda17293c50027d31681a41f
Signature · 1 line
gitgitgadget
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 12 lines · Junio C Hamano
Quoted 5 lines · Christopher via GitGitGadget
From: Christopher Schenk <[email protected]>
When the username and password are supplied in a url like this
https://myuser:[email protected]/myrepo.git and the server supports the negotiate authenticaten method git does not fall back to basic auth ands/method git/method, git/;
Quoted 1 line
libcurl hardly tries to authenticate with the negotiate method.
Quoted 7 lines
Thanks.
Quoted 2 lines
Stop using the Negotiate authentication method after the first failure because if it fails on the first try it will never succeed.
Is this patch needed because we are using cURL library incorrectly, or is it the limitation of the cURL library?
I'm no cURL expert, but in my opinon this is a limitation of the cURL Libary.
Quoted 7 lines
Quoted 3 lines
V1 of this patch somehow did not make it to the mailing list so i will try to send this patch again
The last paragraph does not belong to the commit log message; if nobody on the list saw the "v1", as far as the project is concerned, it never happened.
I have adapted the commit message accordingly.
Quoted 38 lines
Quoted 13 lines
Signed-off-by Christopher Schenk <[email protected]>---
http.c +1
-0@@ -1642,6 +1642,14 @@ static int handle_curl_result(struct slot_results *results)return HTTP_MISSING_TARGET ; else if (results->http_code == 401) {if (http_auth.username && http_auth.password) { +#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY http.c static int handle_curl_result(struct slot_results *results) · line 1655
Quoted 10 lines
http.c +7
-0+if (results->auth_avail &CURLAUTH_GSSNEGOTIATE ) { + http_auth_methods &= ~CURLAUTH_GSSNEGOTIATE ; + http_auth_methods &= results->auth_avail; + http_auth_methods_restricted =1 ; +return HTTP_REAUTH ; + } +#endif credential_reject (&http_auth);return HTTP_NOAUTH ; }else {Hmph, is this an extension to what
4dbe6646(remote-curl: fall back to Basic auth if Negotiate fails, 2015-01-08) tried to do? What happens on the "else" side after the context of this patch, which seems to have come from:-
4dbe6646(remote-curl: fall back to Basic auth if Negotiatefails, 2015-01-08)-
840398fe(http: restrict auth methods to what the serveradvertises, 2017-02-22), and-
40a18fc7(http: add an "auto" mode for http.emptyauth,2017-02-25),
Quoted 9 lines
looks essentially the same as what this patch is adding, and I am wondering if there is a room for simplification. It almost looks to me that the only difference between "credential fully given" and other case is if we "reject" the credential after this patch.
Asking contributors who made these past contributions for input.
Thanks.
I have simplified the code and sent the patch again.
Thanks.