{"thread":{"id":"40343","subject":"No negotiation for repos on HTTP servers?","startedAt":"2015-09-13T19:31:54Z","lastAt":"2015-09-13T21:19:22Z","messageCount":2,"participants":["Christoffer Haglund","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"269891","messageId":"CAGHtn=oXUa2=n2aMWQKndDSfGZ2bPm-dxZ7jin7QOx8dRxp3Kw@mail.gmail.com","threadId":"40343","inReplyTo":null,"subject":"No negotiation for repos on HTTP servers?","fromName":"Christoffer Haglund","fromEmail":"christoffer.haglund@gmail.com","sentAt":"2015-09-13T19:31:54Z","receivedAt":"2015-09-13T19:31:54Z","isPatch":false,"sender":{"key":"christoffer.haglund@gmail.com","avatar":null},"body":"Hi,\n\nI wonder if I've hit a bug in git, or perhaps in libcurl.\n\nOur team that use git repos hosted on a number of different\nenvironments, including HTTP servers using Kerberos or NTLM to\nauthenticate users. Command-line git needs explicit credentials to\nwork against these repos, while Visual Studio (i.e. libgit2) does not.\nThe other day I noticed that when I give null credentials (i.e. empty\nusername and password) normal command-line git works beautifully,\nauthenticating as the currently signed-in user.\n\nI digged around a bit and found a potential bug in how libcurl is\nused; when using CURLAUTH_ANY, no handshaking will actually be done\nunless a user name is specified - even if it's a fake one.\n\nThis is consistent with the documentation for curl itself,\nhttp://curl.haxx.se/docs/manpage.html#--negotiate , however I see no\nmention of this quirk in the libcurl API documentation.\n\nThe fix I'm using locally is quite straightforward:\n\n\ndiff --git a/http.c b/http.c\nindex 9dce380..f62f6b6 100644\n--- a/http.c\n+++ b/http.c\n@@ -668,6 +668,10 @@ struct active_request_slot *get_active_slot(void)\n #endif\n        if (http_auth.password)\n                init_curl_http_auth(slot->curl);\n+#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY\n+       else\n+               curl_easy_setopt(slot->curl, CURLOPT_USERNAME, \"\");\n+#endif\n        return slot;\n }\n\n\nAs far as I can tell this works fine against NTLM and Kerberos HTTP\nservers, and has no effect on servers allowing anonymous access.\n\nAgainst a server using Basic authentication the patch will cause git\nto fire off a redundant 'GET' with the empty username before asking\nthe user for credentials. I'm not sure if that could cause problems\nfor other users, I would expect that anyone working against a server\nwith Basic authentication uses stored credentials anyway :-)\n\nBut perhaps there is some other case I've not considered?\n\n  // Christoffer\n"},{"id":"269892","messageId":"20150913211922.GF8394@vauxhall.crustytoothpaste.net","threadId":"40343","inReplyTo":"CAGHtn=oXUa2=n2aMWQKndDSfGZ2bPm-dxZ7jin7QOx8dRxp3Kw@mail.gmail.com","subject":"Re: No negotiation for repos on HTTP servers?","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2015-09-13T21:19:22Z","receivedAt":"2015-09-13T21:19:22Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Sun, Sep 13, 2015 at 09:31:54PM +0200, Christoffer Haglund wrote:\n> Our team that use git repos hosted on a number of different\n> environments, including HTTP servers using Kerberos or NTLM to\n> authenticate users. Command-line git needs explicit credentials to\n> work against these repos, while Visual Studio (i.e. libgit2) does not.\n> The other day I noticed that when I give null credentials (i.e. empty\n> username and password) normal command-line git works beautifully,\n> authenticating as the currently signed-in user.\n> \n> I digged around a bit and found a potential bug in how libcurl is\n> used; when using CURLAUTH_ANY, no handshaking will actually be done\n> unless a user name is specified - even if it's a fake one.\n\nYes, this is correct.  My general strategy with Kerberos is to use the\nactual username, but you could simply use a dummy (e.g. git@).  This\nisn't really a bug in git so much as a limitation in libcurl.\n\nlibgit2 doesn't have this problem because it doesn't use libcurl.  Of\ncourse, it has it's own problems, like its SSH support not doing\nKerberos.\n\n> This is consistent with the documentation for curl itself,\n> http://curl.haxx.se/docs/manpage.html#--negotiate , however I see no\n> mention of this quirk in the libcurl API documentation.\n\nIt is present somewhere in there, but it's not easy to find, I'll admit.\n\n> Against a server using Basic authentication the patch will cause git\n> to fire off a redundant 'GET' with the empty username before asking\n> the user for credentials. I'm not sure if that could cause problems\n> for other users, I would expect that anyone working against a server\n> with Basic authentication uses stored credentials anyway :-)\n\nI don't see any problems with this.  I'd suggest sending the patch as\nspecified in Documentation/SubmittingPatches, and it's likely Junio will\npick it up.\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | https://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"}]}