{"thread":{"id":"26447","subject":"Supporting Kerberos auth over HTTP (mod_auth_kerb)","startedAt":"2011-02-08T17:07:12Z","lastAt":"2011-02-08T17:07:12Z","messageCount":1,"participants":["Nick"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"160704","messageId":"AANLkTimUJjUBkbjPeq4+bsnwGqxrmj61W5qZmGQNy6Ah@mail.gmail.com","threadId":"26447","inReplyTo":null,"subject":"Supporting Kerberos auth over HTTP (mod_auth_kerb)","fromName":"Nick","fromEmail":"f99@2thebatcave.com","sentAt":"2011-02-08T17:07:12Z","receivedAt":"2011-02-08T17:07:12Z","isPatch":false,"sender":{"key":"f99@2thebatcave.com","avatar":null},"body":"Has anyone gotten negotiable authentication to work with git over http\nusing mod_auth_kerb on the server end?  I am unable to get a git\nclient to function correctly in this scenario.  I am defining\n\"correctly\" as the following:\n\nWhen a valid kerberos ticket is available, use that without prompting\nfor credentials.  If for some reason that fails, prompt for\ncredentials and try again using HTTP basic auth.\n\nIf no valid kerberos ticket is available, prompt for credentials and\ntry using HTTP basic auth.\n\n\n\nSo far the behavior I have been able to reproduce:\n\nWhen 'KrbMethodNegotiate off' is set on the server, the git client\nwill always prompt for username and password and use them.  This is\nvery intuitive from the user perspective, but does not take advantage\nof the kerberos ticket for single sign-on.\n\nWhen 'KrbMethodNegotiate on' is set on the server, the git client will\nalways prompt for username and password, but ignore them.  If a valid\nkerberos ticket is available, the command will complete after any\narbitrary text is entered into the username and password prompts.  If\na valid kerberos ticket is not available, the command will fail even\nif the correct username and password is entered.\n\nUsing some combinations of various git and curl versions and compile\noptions will not even get that far, and respond immediately with a\n401.\n\n\nI have tried several different versions of git, including the latest\n1.7.4.  I have tried several different versions of curl, including the\nlatest 7.12.3.  I have tried several different curl compile-time\nconfiguration options, including --with-spenego (using fbopenssl) and\n--with-gssapi.\n"}]}