{"thread":{"id":"24503","subject":"Re: git-core: please support GSS-Negotiate authentication for http","startedAt":"2010-07-25T02:39:31Z","lastAt":"2010-07-25T02:39:31Z","messageCount":1,"participants":["Jonathan Nieder"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"146241","messageId":"20100725023930.GC18606@burratino","threadId":"24503","inReplyTo":null,"subject":"Re: git-core: please support GSS-Negotiate authentication for http","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2010-07-25T02:39:31Z","receivedAt":"2010-07-25T02:39:31Z","isPatch":false,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Hi transport experts,\n\nThis report came in a couple of months ago; I was thinking of trying\nto reproduce it, but that was silly, since it is way over my head.  It\nseems that some HTTP authentication scheme is not working well in some\ncircumstance. ;-)\n\nIdeas?\n\n\nOn Sun, May 16, 2010 at 06:45:33AM -0500, Jonathan Nieder wrote:\n> reassign 472073 git git-core/1:1.5.4.4-1\n> tags 472073 + upstream\n> quit\n> \n> Hi Brian,\n> \n> brian m. carlson wrote:\n> \n> > My webserver supports Kerberos 5 and DAV, but for the obvious\n> > reason, DAV is only allowed with Kerberos (GSS-Negotiate)\n> > authentication.  It would be nice if I could use GSS-Negotiate with\n> > git, since it is supported by libcurl.\n> \n> I do not know how to check this, but could you try with version 1.7.0\n> or 1.7.1?  The patch v1.7.0-rc0~108^2~2 (Add an option for using any\n> HTTP authentication scheme, not only basic, 2009-11-27[1]) and its\n> companion patch v1.7.0-rc0~108^2 (Remove http.authAny[2]) seem\n> relevant.\n\nIt doesn't seem to work for me:\n\n  lakeview no % git push http://bmc@castro.crustytoothpaste.net/dump/css.git master\n  Password: \n  Password: \n  error: The requested URL returned error: 401 while accessing http://bmc@castro.crustytoothpaste.net/dump/css.git/info/refs\n  \n  error: The requested URL returned error: 401 while accessing http://bmc@castro.crustytoothpaste.net/dump/css.git/objects/info/packs\n  \n  Unable to create branch path http://bmc@castro.crustytoothpaste.net/dump/css.git/info/\n  error: cannot lock existing info/refs\n  fatal: git-http-push failed\n\nAlso, here's part of the log from the web server:\n\n  172.16.2.249 - - [28/May/2010:13:44:20 +0000] \"GET /dump/css.git/info/refs?service=git-receive-pack HTTP/1.1\" 401 720 \"-\" \"git/1.7.1\"\n  172.16.2.249 - - [28/May/2010:13:44:20 +0000] \"GET /dump/css.git/info/refs HTTP/1.1\" 401 720 \"-\" \"git/1.7.1\"\n  172.16.2.249 - - [28/May/2010:13:44:24 +0000] \"GET /dump/css.git/info/refs?service=git-receive-pack HTTP/1.1\" 401 720 \"-\" \"git/1.7.1\"\n  172.16.2.249 - bmc@CRUSTYTOOTHPASTE.NET [28/May/2010:13:44:24 +0000] \"GET /dump/css.git/info/refs?service=git-receive-pack HTTP/1.1\" 200 307 \"-\" \"git/1.7.1\"\n  172.16.2.249 - - [28/May/2010:13:44:24 +0000] \"GET /dump/css.git/HEAD HTTP/1.1\" 401 720 \"-\" \"git/1.7.1\"\n  172.16.2.249 - - [28/May/2010:13:44:25 +0000] \"PROPFIND /dump/css.git/ HTTP/1.1\" 401 720 \"-\" \"git/1.7.1\"\n  172.16.2.249 - bmc@CRUSTYTOOTHPASTE.NET [28/May/2010:13:44:25 +0000] \"PROPFIND /dump/css.git/ HTTP/1.1\" 207 767 \"-\" \"git/1.7.1\"\n  172.16.2.249 - - [28/May/2010:13:44:25 +0000] \"HEAD /dump/css.git/info/refs HTTP/1.1\" 401 205 \"-\" \"git/1.7.1\"\n  172.16.2.249 - - [28/May/2010:13:44:25 +0000] \"HEAD /dump/css.git/objects/info/packs HTTP/1.1\" 401 205 \"-\" \"git/1.7.1\"\n  172.16.2.249 - - [28/May/2010:13:44:25 +0000] \"MKCOL /dump/css.git/info/ HTTP/1.1\" 401 720 \"-\" \"git/1.7.1\"\n\nNotice that only for certain requests does git use authentication.  It\nneeds to use authentication for every request, since access to /dump/ is\nonly allowed to valid users using Kerberos (for all requests).\n\nAlso note that git prompts for a password when one is not needed; this\nis probably part of the curl bug noted in the manpage:\n\n  When using this option, you must also provide a fake -u/--user option\n  to activate the authentication code properly. Sending a '-u :' is\n  enough as the user name and password from the -u option aren't\n  actually used.\n\nUsing \"bmc:@\" instead of \"bmc@\" in the URI makes no difference.  If you\nneed me to do more testing, please let me know.\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"}]}