{"thread":{"id":"39141","subject":"forcing a user@ into the URL if not present","startedAt":"2015-04-22T20:06:41Z","lastAt":"2015-05-06T17:18:18Z","messageCount":10,"participants":["Dan Langille","brian m. carlson","Johannes Schindelin","Junio C Hamano","Torsten Bögershausen"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"259843","messageId":"CABU7BddjAZOk0LyybQ8phO0S4705MrZtLSYEsjzUBKUD=H++RQ@mail.gmail.com","threadId":"39141","inReplyTo":null,"subject":"forcing a user@ into the URL if not present","fromName":"Dan Langille","fromEmail":"dlangille@sourcefire.com","sentAt":"2015-04-22T20:06:41Z","receivedAt":"2015-04-22T20:06:41Z","isPatch":false,"sender":{"key":"dlangille@sourcefire.com","avatar":null},"body":"Hello,\n\nI'm using git 2.3.2 with Kerberos for authentication and gito-lite for\nauthorization.\n\nThis works:\n\n$ git clone https://dvl@ repo.example.org/git/testing\nCloning into 'testing'...\nwarning: You appear to have cloned an empty repository.\nChecking connectivity... done.\n\nMy goal: have it work without supplying dvl@ as shown here:\n\n$ git clone https://repo.example.org/git/testing\nCloning into 'testing'...\nUsername for 'https://repo.example.org':\n\nI don't want to be prompted for a password. I want Kerberos to kick in.\n\nFollowing http://git-scm.com/docs/gitcredentials, the following seems to\nhave nil effect. Anyone used this feature already?\n\n git config --global credential.https://repo.example.org.username dvl\n\n$ cat ~/.gitconfig\n[credential \"https://repo.example.org\"]\nusername = dvl\n[http]\nsslCAInfo = /usr/local/etc/trusted-certificates.pem\n\nWith the above, I still get prompted for a password\n\nGiven my use of Kerberos for authorization, is this option feasible?\n\nShould I be taking a different approach?\n\nThank you.\n\n-- \nDan Langille\nInfrastructure & Operations\nTalos Group\nSourcefire, Inc.\n"},{"id":"260303","messageId":"CABU7BddHuiYK4s+_+Z9v15D+Nj8icMQSWNY13TZ77wq8Vo6r+A@mail.gmail.com","threadId":"39141","inReplyTo":"CABU7BddjAZOk0LyybQ8phO0S4705MrZtLSYEsjzUBKUD=H++RQ@mail.gmail.com","subject":"Re: forcing a user@ into the URL if not present","fromName":"Dan Langille","fromEmail":"dlangille@sourcefire.com","sentAt":"2015-04-30T20:14:12Z","receivedAt":"2015-04-30T20:14:12Z","isPatch":false,"sender":{"key":"dlangille@sourcefire.com","avatar":null},"body":"Would this question be better suited for another list?\n\nOn Wed, Apr 22, 2015 at 4:06 PM, Dan Langille wrote:\n> Hello,\n>\n> I'm using git 2.3.2 with Kerberos for authentication and gito-lite for\n> authorization.\n>\n> This works:\n>\n> $ git clone https://dvl@ repo.example.org/git/testing\n> Cloning into 'testing'...\n> warning: You appear to have cloned an empty repository.\n> Checking connectivity... done.\n>\n> My goal: have it work without supplying dvl@ as shown here:\n>\n> $ git clone https://repo.example.org/git/testing\n> Cloning into 'testing'...\n> Username for 'https://repo.example.org':\n>\n> I don't want to be prompted for a password. I want Kerberos to kick in.\n>\n> Following http://git-scm.com/docs/gitcredentials, the following seems to\n> have nil effect. Anyone used this feature already?\n>\n> git config --global credential.https://repo.example.org.username dvl\n>\n> $ cat ~/.gitconfig\n> [credential \"https://repo.example.org\"]\n> username = dvl\n> [http]\n> sslCAInfo = /usr/local/etc/trusted-certificates.pem\n>\n> With the above, I still get prompted for a password\n>\n> Given my use of Kerberos for authorization, is this option feasible?\n>\n> Should I be taking a different approach?\n>\n> Thank you.\n>\n> --\n> Dan Langille\n> Infrastructure & Operations\n> Talos Group\n> Sourcefire, Inc.\n\n\n\n-- \nDan Langille\nInfrastructure & Operations\nTalos Group\nSourcefire, Inc.\n"},{"id":"260304","messageId":"20150430202342.GC5015@vauxhall.crustytoothpaste.net","threadId":"39141","inReplyTo":"CABU7BddHuiYK4s+_+Z9v15D+Nj8icMQSWNY13TZ77wq8Vo6r+A@mail.gmail.com","subject":"Re: forcing a user@ into the URL if not present","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2015-04-30T20:23:42Z","receivedAt":"2015-04-30T20:23:42Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Thu, Apr 30, 2015 at 04:14:12PM -0400, Dan Langille wrote:\n> Would this question be better suited for another list?\n\nNope, this is the place to go.\n\n> On Wed, Apr 22, 2015 at 4:06 PM, Dan Langille wrote:\n> > Hello,\n> >\n> > I'm using git 2.3.2 with Kerberos for authentication and gito-lite for\n> > authorization.\n> >\n> > This works:\n> >\n> > $ git clone https://dvl@ repo.example.org/git/testing\n> > Cloning into 'testing'...\n> > warning: You appear to have cloned an empty repository.\n> > Checking connectivity... done.\n> >\n> > My goal: have it work without supplying dvl@ as shown here:\n> >\n> > $ git clone https://repo.example.org/git/testing\n> > Cloning into 'testing'...\n> > Username for 'https://repo.example.org':\n> >\n> > I don't want to be prompted for a password. I want Kerberos to kick in.\n> >\n> > Following http://git-scm.com/docs/gitcredentials, the following seems to\n> > have nil effect. Anyone used this feature already?\n> >\n> > git config --global credential.https://repo.example.org.username dvl\n> >\n> > $ cat ~/.gitconfig\n> > [credential \"https://repo.example.org\"]\n> > username = dvl\n> > [http]\n> > sslCAInfo = /usr/local/etc/trusted-certificates.pem\n> >\n> > With the above, I still get prompted for a password\n> >\n> > Given my use of Kerberos for authorization, is this option feasible?\n\nNot at the present time. The only time that the credential API is\ninvoked is if it prompts for a password, and by that point you've fallen\nback to Basic authentication.\n\n> > Should I be taking a different approach?\n\nIf you want it to work only with Kerberos, then any username in the URL\nis fine, as libcurl doesn't care.\n\nOne thing you could try is to make your URL https://git@repo.example.org\nand then use\n\n git config --global credential.https://git@repo.example.org.username dvl\n\nand see if it does the right thing for both Kerberos and Basic auth. It\nwould be sort of a hack, but it might work.\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"},{"id":"260542","messageId":"CABU7BdcuJp3f6_cN8TpJX-brDUWL6-0Q5M0Yvpg2ND-k--yEbw@mail.gmail.com","threadId":"39141","inReplyTo":"20150430202342.GC5015@vauxhall.crustytoothpaste.net","subject":"Re: forcing a user@ into the URL if not present","fromName":"Dan Langille","fromEmail":"dlangille@sourcefire.com","sentAt":"2015-05-04T19:35:00Z","receivedAt":"2015-05-04T19:35:00Z","isPatch":false,"sender":{"key":"dlangille@sourcefire.com","avatar":null},"body":"On Thu, Apr 30, 2015 at 4:23 PM, brian m. carlson\n wrote:\n> On Thu, Apr 30, 2015 at 04:14:12PM -0400, Dan Langille wrote:\n>> Would this question be better suited for another list?\n>\n> Nope, this is the place to go.\n>\n>> On Wed, Apr 22, 2015 at 4:06 PM, Dan Langille wrote:\n>> > Hello,\n>> >\n>> > I'm using git 2.3.2 with Kerberos for authentication and gito-lite for\n>> > authorization.\n>> >\n>> > This works:\n>> >\n>> > $ git clone https://dvl@ repo.example.org/git/testing\n>> > Cloning into 'testing'...\n>> > warning: You appear to have cloned an empty repository.\n>> > Checking connectivity... done.\n>> >\n>> > My goal: have it work without supplying dvl@ as shown here:\n>> >\n>> > $ git clone https://repo.example.org/git/testing\n>> > Cloning into 'testing'...\n>> > Username for 'https://repo.example.org':\n>> >\n>> > I don't want to be prompted for a password. I want Kerberos to kick in.\n>> >\n>> > Following http://git-scm.com/docs/gitcredentials, the following seems to\n>> > have nil effect. Anyone used this feature already?\n>> >\n>> > git config --global credential.https://repo.example.org.username dvl\n>> >\n>> > $ cat ~/.gitconfig\n>> > [credential \"https://repo.example.org\"]\n>> > username = dvl\n>> > [http]\n>> > sslCAInfo = /usr/local/etc/trusted-certificates.pem\n>> >\n>> > With the above, I still get prompted for a password\n>> >\n>> > Given my use of Kerberos for authorization, is this option feasible?\n>\n> Not at the present time. The only time that the credential API is\n> invoked is if it prompts for a password, and by that point you've fallen\n> back to Basic authentication.\n>\n>> > Should I be taking a different approach?\n>\n> If you want it to work only with Kerberos, then any username in the URL\n> is fine, as libcurl doesn't care.\n\nThat is what I found during testing. So long as I put a username in\nthe URL, Kerberos worked\nand all authentication occurred as expected.\n\n>> One thing you could try is to make your URL https://git@repo.example.org\n> and then use\n>\n> git config --global credential.https://git@repo.example.org.username dvl\n>\n> and see if it does the right thing for both Kerberos and Basic auth. It\n> would be sort of a hack, but it might work.\n\nIt asks for a password, and for the correct user:\n\nPassword for 'https://dvl@repo.example.org':\n\nThanks Brian, for this, and your other help. I appreciate it.\n\n-- \nDan Langille\nInfrastructure & Operations\nTalos Group\nSourcefire, Inc.\n"},{"id":"260589","messageId":"CABU7BddLGe-+b4cEiPi9MCd6xY5kpBU6aZuy4Vn7j+NgPdLwuA@mail.gmail.com","threadId":"39141","inReplyTo":"CABU7BdcuJp3f6_cN8TpJX-brDUWL6-0Q5M0Yvpg2ND-k--yEbw@mail.gmail.com","subject":"Re: forcing a user@ into the URL if not present","fromName":"Dan Langille","fromEmail":"dlangille@sourcefire.com","sentAt":"2015-05-05T12:35:57Z","receivedAt":"2015-05-05T12:35:57Z","isPatch":false,"sender":{"key":"dlangille@sourcefire.com","avatar":null},"body":"On Mon, May 4, 2015 at 3:35 PM, Dan Langille wrote:\n> On Thu, Apr 30, 2015 at 4:23 PM, brian m. carlson\n> wrote:\n>> On Thu, Apr 30, 2015 at 04:14:12PM -0400, Dan Langille wrote:\n>>> Would this question be better suited for another list?\n>>\n>> Nope, this is the place to go.\n>>\n>>> On Wed, Apr 22, 2015 at 4:06 PM, Dan Langille wrote:\n>>> > Hello,\n>>> >\n>>> > I'm using git 2.3.2 with Kerberos for authentication and gito-lite for\n>>> > authorization.\n>>> >\n>>> > This works:\n>>> >\n>>> > $ git clone https://dvl@ repo.example.org/git/testing\n>>> > Cloning into 'testing'...\n>>> > warning: You appear to have cloned an empty repository.\n>>> > Checking connectivity... done.\n>>> >\n>>> > My goal: have it work without supplying dvl@ as shown here:\n>>> >\n>>> > $ git clone https://repo.example.org/git/testing\n>>> > Cloning into 'testing'...\n>>> > Username for 'https://repo.example.org':\n>>> >\n>>> > I don't want to be prompted for a password. I want Kerberos to kick in.\n>>> >\n>>> > Following http://git-scm.com/docs/gitcredentials, the following seems to\n>>> > have nil effect. Anyone used this feature already?\n>>> >\n>>> > git config --global credential.https://repo.example.org.username dvl\n>>> >\n>>> > $ cat ~/.gitconfig\n>>> > [credential \"https://repo.example.org\"]\n>>> > username = dvl\n>>> > [http]\n>>> > sslCAInfo = /usr/local/etc/trusted-certificates.pem\n>>> >\n>>> > With the above, I still get prompted for a password\n>>> >\n>>> > Given my use of Kerberos for authorization, is this option feasible?\n>>\n>> Not at the present time. The only time that the credential API is\n>> invoked is if it prompts for a password, and by that point you've fallen\n>> back to Basic authentication.\n>>\n>>> > Should I be taking a different approach?\n>>\n>> If you want it to work only with Kerberos, then any username in the URL\n>> is fine, as libcurl doesn't care.\n>\n> That is what I found during testing. So long as I put a username in\n> the URL, Kerberos worked\n> and all authentication occurred as expected.\n\nAs I understand it, in order to invoke Kerberos Authentication, a\nusername must be in the URL, but that username is not involved in the\nauthentication process. Thus, the username in the config is never\napplied to any URL and does not not work the same way as a username\nwhich appears in the URL.\n\nI suspect this is because a username in the URL invokes\nauthentication, which prompts the whole Kerberos process.\n\nThe best workaround I've found is this configuration item:\n\n[url \"https://FOO@repo.example.org\"]\n insteadOf = https://repo.example.org\n\nWe'd be happy if we could set this as a global config setting and not\nhave the users prompted for a password. The whole beauty of Kerberos\nis not getting prompted for stuff. Am I simply failing to comprehend\nthe steps involved in Kerberos Authentication?\n\nWhat bits of code would need looking at in order for git\nauthentication to work seamlessly with Kerberos? We are so close.\n\n-- \nDan Langille\nInfrastructure & Operations\nTalos Group\nSourcefire, Inc.\n"},{"id":"260591","messageId":"231730bb9947a6ddbbd8f3bda36c89f2@www.dscho.org","threadId":"39141","inReplyTo":"CABU7BddLGe-+b4cEiPi9MCd6xY5kpBU6aZuy4Vn7j+NgPdLwuA@mail.gmail.com","subject":"Re: forcing a user@ into the URL if not present","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2015-05-05T13:59:50Z","receivedAt":"2015-05-05T13:59:50Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Dan,\n\nOn 2015-05-05 14:35, Dan Langille wrote:\n\n> As I understand it, in order to invoke Kerberos Authentication, a\n> username must be in the URL, but that username is not involved in the\n> authentication process.\n\nHaving stumbled over [this ticket](https://github.com/git-for-windows/git/issues/92) recently, it appears to me as if the following should work for you:\n\ngit clone https://:@repo.example.org/\n\nCiao,\nJohannes\n"},{"id":"260604","messageId":"xmqqmw1iex4m.fsf@gitster.dls.corp.google.com","threadId":"39141","inReplyTo":"231730bb9947a6ddbbd8f3bda36c89f2@www.dscho.org","subject":"Re: forcing a user@ into the URL if not present","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-05-05T17:45:45Z","receivedAt":"2015-05-05T17:45:45Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin writes:\n\n> Having stumbled over [this\n> ticket](https://github.com/git-for-windows/git/issues/92) recently, it\n> appears to me as if the following should work for you:\n>\n> git clone https://:@repo.example.org/\n\nWow.\n\nIs this a windows-only SSPI thing, or is this a widely accepted URL\nconvention? I haven't seen anybody use such a URL but I would say\nthat is a natural thing to expect to work, as both username and\npassword are missing so they should default to some sensible values,\nin this case \"current user, shouldn't need password\", just like\n\"scheme://site:/\" is \"port missing so it should default to some\nsensible value, appropriate for the scheme\".\n\nI think Torsten recently added a bit more test for our URL parsing\ncode, especially for \"scheme://site:/\" (missing port), but I do not\nthink we have \"scheme://:site/\" (missing user or password). Perhaps\nwe would want to have additional tests to cover this shape of URL?\n\nThanks.\n"},{"id":"260643","messageId":"55499E10.2050003@web.de","threadId":"39141","inReplyTo":"xmqqmw1iex4m.fsf@gitster.dls.corp.google.com","subject":"Re: forcing a user@ into the URL if not present","fromName":"Torsten Bögershausen","fromEmail":"tboegi@web.de","sentAt":"2015-05-06T04:52:32Z","receivedAt":"2015-05-06T04:52:32Z","isPatch":false,"sender":{"key":"tboegi@web.de","avatar":"https://avatars.githubusercontent.com/u/7138363?v=4"},"body":"On 05/05/2015 07:45 PM, Junio C Hamano wrote:\n> Johannes Schindelin writes:\n>\n>> Having stumbled over [this\n>> ticket](https://github.com/git-for-windows/git/issues/92) recently, it\n>> appears to me as if the following should work for you:\n>>\n>> git clone https://:@repo.example.org/\n> Wow.\n>\n> Is this a windows-only SSPI thing, or is this a widely accepted URL\n> convention? I haven't seen anybody use such a URL but I would say\n> that is a natural thing to expect to work, as both username and\n> password are missing so they should default to some sensible values,\n> in this case \"current user, shouldn't need password\", just like\n> \"scheme://site:/\" is \"port missing so it should default to some\n> sensible value, appropriate for the scheme\".\n>\n> I think Torsten recently added a bit more test for our URL parsing\n> code, especially for \"scheme://site:/\" (missing port), but I do not\n> think we have \"scheme://:site/\" (missing user or password). Perhaps\n> we would want to have additional tests to cover this shape of URL?\n>\nI have added tests for URL parsing, but for host names/port numbers.\nNot for usernames/passwords (passwords shouldn't be there,\nrecommends RFC 3986)\n\nAnd only for the ssh:// protocol, as well as git://.\nhttp:// and https:// are not handled by connect.c at all,\nand I'm not really familiar with curl, nor kerberos.\n\nIn other words: I can not help very much at the moment.\n"},{"id":"260645","messageId":"e8793cf6c07dcfcfa835dbc4c438918f@www.dscho.org","threadId":"39141","inReplyTo":"55499E10.2050003@web.de","subject":"Re: forcing a user@ into the URL if not present","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2015-05-06T05:29:20Z","receivedAt":"2015-05-06T05:29:20Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Torsten & Junio,\n\nOn 2015-05-06 06:52, Torsten Bögershausen wrote:\n> On 05/05/2015 07:45 PM, Junio C Hamano wrote:\n>> Johannes Schindelin writes:\n>>\n>>> Having stumbled over [this\n>>> ticket](https://github.com/git-for-windows/git/issues/92) recently, it\n>>> appears to me as if the following should work for you:\n>>>\n>>> git clone https://:@repo.example.org/\n>>\n>> Wow.\n\nMy reaction exactly.\n\n>> Is this a windows-only SSPI thing, or is this a widely accepted URL convention?\n\nQuite frankly, I have no idea. Before reading that ticket, I did not even think of trying such a convention.\n\n>> I haven't seen anybody use such a URL but I would say that is a natural thing to expect to work, as both username and password are missing so they should default to some sensible values, in this case \"current user, shouldn't need password\", just like \"scheme://site:/\" is \"port missing so it should default to some sensible value, appropriate for the scheme\".\n\nYes, that makes total sense to me, too. In fact, I found it rather clever once I got over the surprise.\n\n>> I think Torsten recently added a bit more test for our URL parsing\n>> code, especially for \"scheme://site:/\" (missing port), but I do not\n>> think we have \"scheme://:site/\" (missing user or password). Perhaps\n>> we would want to have additional tests to cover this shape of URL?\n>>\n> I have added tests for URL parsing, but for host names/port numbers.\n> Not for usernames/passwords (passwords shouldn't be there,\n> recommends RFC 3986)\n> \n> And only for the ssh:// protocol, as well as git://.\n> http:// and https:// are not handled by connect.c at all,\n> and I'm not really familiar with curl, nor kerberos.\n\nTBH it does not seem overly urgent to add those tests for the HTTPS handling. From a cursory look it seems that neither `transport_helper_init()` nor any code in `remote-curl.c` parses the \"\" part of the URL, or for that matter puts restrictions on it. The issue I linked to was with a cURL that was compiled without support for the particular authentication method configured for the credential helper.\n\nSo I fear that testing the KERBEROS support would be the duty of an integration test (which we do not have so far) rather than a unit test.\n\nCiao,\nDscho\n"},{"id":"260667","messageId":"xmqqsib9bp5x.fsf@gitster.dls.corp.google.com","threadId":"39141","inReplyTo":"e8793cf6c07dcfcfa835dbc4c438918f@www.dscho.org","subject":"Re: forcing a user@ into the URL if not present","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-05-06T17:18:18Z","receivedAt":"2015-05-06T17:18:18Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin writes:\n\n>>> I haven't seen anybody use such a URL but I would say that is a\n>>> natural thing to expect to work, as both username and password are\n>>> missing so they should default to some sensible values, in this\n>>> case \"current user, shouldn't need password\", just like\n>>> \"scheme://site:/\" is \"port missing so it should default to some\n>>> sensible value, appropriate for the scheme\".\n>\n> Yes, that makes total sense to me, too. In fact, I found it rather\n> clever once I got over the surprise.\n\nYup, I'd happily call that \"clever\" ;-)\n\n> TBH it does not seem overly urgent to add those tests for the HTTPS\n> handling. From a cursory look it seems that neither\n> transport_helper_init()` nor any code in `remote-curl.c` parses the\n> \"\" part of the URL, or for that matter puts\n> restrictions on it.\n\nThanks for checking.\n"}]}