{"thread":{"id":"54398","subject":"How to Verify the Git Credentials supplied by the User","startedAt":"2020-10-12T13:51:24Z","lastAt":"2020-10-13T05:32:18Z","messageCount":4,"participants":["Deepak Patankar","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"407336","messageId":"CABmmNJOGBdEO+AT0_8dSwmFxomFE7A5x354+YgfxiU5N+mOroA@mail.gmail.com","threadId":"54398","inReplyTo":null,"subject":"How to Verify the Git Credentials supplied by the User","fromName":"Deepak Patankar","fromEmail":"patankardeepak04@gmail.com","sentAt":"2020-10-12T13:50:42Z","receivedAt":"2020-10-12T13:51:24Z","isPatch":false,"sender":{"key":"patankardeepak04@gmail.com","avatar":null},"body":"Hello!!\n\nI am writing an application in which we will support git integration.\nThe user will provide us with his/her git credentials so that we can\npush some files on his git. The git credentials which user will supply\ncan be\n\nHTTP (Username and Password/ Kerberos)\nSSH\n\nBefore saving the user credentials I want to validate that the\ncredentials entered is valid.\n\nThe user might be using GithHub/BitBucket/GitLab. I am trying to find\nsome git command which I can use to validate the credentials. Can you\nplease point me to some command/logic which I can try?\n\nWhat I have tried?\nI tried git ls-remote command, but it requires the repo name/url. In\none of our use case, the user won't specify the repository name\nbeforehand. Because of which I am not able to use this command.\n\n\nThanks\nDeepak Patankar\n"},{"id":"407354","messageId":"xmqqsgajpcan.fsf@gitster.c.googlers.com","threadId":"54398","inReplyTo":"CABmmNJOGBdEO+AT0_8dSwmFxomFE7A5x354+YgfxiU5N+mOroA@mail.gmail.com","subject":"Re: How to Verify the Git Credentials supplied by the User","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2020-10-12T17:46:40Z","receivedAt":"2020-10-12T17:46:45Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Deepak Patankar writes:\n\n> I am writing an application in which we will support git integration.\n> The user will provide us with his/her git credentials so that we can\n> push some files on his git. The git credentials which user will supply\n> can be\n>\n> HTTP (Username and Password/ Kerberos)\n> SSH\n>\n> Before saving the user credentials I want to validate that the\n> credentials entered is valid.\n\nIt obviously depends on the remote side, but a relatively safe thing\nto try is to run things like \"ls-remote\" or \"push --dry-run\" that\nwill not cause any actual damage against the remote, and see if your\nauthentication fail.\n\nBut you might be asking a XY question. I would expect that any\nreasonable application that manages authentication material for the\nuser and drives \"git fetch\" and \"git push\" would act as a credential\nhelper and uses the credential protocol to talk to Git, so it will\nlearn an authentication failure upon the first use, at which point\nit has the chance to drop the authentication material it obtained\nearlier and ask the user for the corrected one---there is no need\nfor the application to see if the authentication material is correct\nbefore the user does anything else.\n\n\n> The user might be using GithHub/BitBucket/GitLab. I am trying to find\n> some git command which I can use to validate the credentials. Can you\n> please point me to some command/logic which I can try?\n>\n> What I have tried?\n> I tried git ls-remote command, but it requires the repo name/url. In\n> one of our use case, the user won't specify the repository name\n> beforehand. Because of which I am not able to use this command.\n\nThis assumes there always is a single authentication material\nregardless of the URL, which is probably not a good security posture\nto encourage the users to adopt.\n"},{"id":"407422","messageId":"CABmmNJMzs=BOYEv_pUaA3NbNkn_HhyOj_VoYeWSKzz138OCZkQ@mail.gmail.com","threadId":"54398","inReplyTo":"CABmmNJOCJEpGwz3hxYsKO=xwx_rrVv5_QcZuS_=gUZH9bM0G2A@mail.gmail.com","subject":"Re: How to Verify the Git Credentials supplied by the User","fromName":"Deepak Patankar","fromEmail":"patankardeepak04@gmail.com","sentAt":"2020-10-13T05:24:15Z","receivedAt":"2020-10-13T05:24:30Z","isPatch":false,"sender":{"key":"patankardeepak04@gmail.com","avatar":null},"body":"Hey Junio,\n\nThanks a lot for the help.\n\nOn Mon, 12 Oct 2020 at 23:16, Junio C Hamano wrote:\n>\n> Deepak Patankar writes:\n>\n> > I am writing an application in which we will support git integration.\n> > The user will provide us with his/her git credentials so that we can\n> > push some files on his git. The git credentials which user will supply\n> > can be\n> >\n> > HTTP (Username and Password/ Kerberos)\n> > SSH\n> >\n> > Before saving the user credentials I want to validate that the\n> > credentials entered is valid.\n>\n> It obviously depends on the remote side, but a relatively safe thing\n> to try is to run things like \"ls-remote\" or \"push --dry-run\" that\n> will not cause any actual damage against the remote, and see if your\n> authentication fail.\n>\n> But you might be asking a XY question. I would expect that any\n> reasonable application that manages authentication material for the\n> user and drives \"git fetch\" and \"git push\" would act as a credential\n> helper and uses the credential protocol to talk to Git, so it will\n> learn an authentication failure upon the first use, at which point\n> it has the chance to drop the authentication material it obtained\n> earlier and ask the user for the corrected one---there is no need\n> for the application to see if the authentication material is correct\n> before the user does anything else.\n>\n\nMy previous email was confusing. I will be doing the authentication\ncheck the way you described above\ni.e. it will be done only once and I won't do it again and again\nbefore each operation.\n\n\nI can use the \"ls-remote\", \"push --dry-run\" command you suggested, but\nI have a use case which I don't know how to solve.\nThe above commands require a repository. In our application, the user\ncan give the following details\n\nGit Details:\n Account URL: https://github.com/OpenPrinting\n UserName: deepakpatankar\n password: ***********\n\nIn this case, we don't know the repo name. At this step, I just know\nthe account and the credentials of the user, later on\nthe user will provide me with the repo name to which he wants to sync his file.\n\nSince I don't know the repository, I cannot do \"git fetch\" or \"git\npush --dry-run\". Can I check this credentials with some\nlogic or git commands?\n\n\nThanks\nDeepak Patankar\n\nOn Tue, 13 Oct 2020 at 10:25, Deepak Patankar\n wrote:\n>\n> Hey Junio,\n>\n> Thanks a lot for the help.\n>\n> On Mon, 12 Oct 2020 at 23:16, Junio C Hamano wrote:\n> >\n> > Deepak Patankar writes:\n> >\n> > > I am writing an application in which we will support git integration.\n> > > The user will provide us with his/her git credentials so that we can\n> > > push some files on his git. The git credentials which user will supply\n> > > can be\n> > >\n> > > HTTP (Username and Password/ Kerberos)\n> > > SSH\n> > >\n> > > Before saving the user credentials I want to validate that the\n> > > credentials entered is valid.\n> >\n> > It obviously depends on the remote side, but a relatively safe thing\n> > to try is to run things like \"ls-remote\" or \"push --dry-run\" that\n> > will not cause any actual damage against the remote, and see if your\n> > authentication fail.\n> >\n> > But you might be asking a XY question. I would expect that any\n> > reasonable application that manages authentication material for the\n> > user and drives \"git fetch\" and \"git push\" would act as a credential\n> > helper and uses the credential protocol to talk to Git, so it will\n> > learn an authentication failure upon the first use, at which point\n> > it has the chance to drop the authentication material it obtained\n> > earlier and ask the user for the corrected one---there is no need\n> > for the application to see if the authentication material is correct\n> > before the user does anything else.\n> >\n>\n> My previous email was confusing. I will be doing the authentication\n> check the way you described above\n> i.e. it will be done only once and I won't do it again and again\n> before each operation.\n>\n>\n> I can use the \"ls-remote\", \"push --dry-run\" command you suggested, but\n> I have a use case which I don't know how to solve.\n> The above commands require a repository. In our application, the user\n> can give the following details\n>\n> Git Details:\n> Account URL: https://github.com/OpenPrinting\n> UserName: deepakpatankar\n> password: ***********\n>\n> In this case, we don't know the repo name. At this step, I just know\n> the account and the credentials of the user, later on\n> the user will provide me with the repo name to which he wants to sync his file.\n>\n> Since I don't know the repository, I cannot do \"git fetch\" or \"git\n> push --dry-run\". Can I check this credentials with some\n> logic or git commands?\n>\n>\n> Thanks\n> Deepak Patankar\n>\n>\n>\n> >\n> > > The user might be using GithHub/BitBucket/GitLab. I am trying to find\n> > > some git command which I can use to validate the credentials. Can you\n> > > please point me to some command/logic which I can try?\n> > >\n> > > What I have tried?\n> > > I tried git ls-remote command, but it requires the repo name/url. In\n> > > one of our use case, the user won't specify the repository name\n> > > beforehand. Because of which I am not able to use this command.\n> >\n> > This assumes there always is a single authentication material\n> > regardless of the URL, which is probably not a good security posture\n> > to encourage the users to adopt.\n"},{"id":"407426","messageId":"xmqqsgailmhu.fsf@gitster.c.googlers.com","threadId":"54398","inReplyTo":"CABmmNJMzs=BOYEv_pUaA3NbNkn_HhyOj_VoYeWSKzz138OCZkQ@mail.gmail.com","subject":"Re: How to Verify the Git Credentials supplied by the User","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2020-10-13T05:32:13Z","receivedAt":"2020-10-13T05:32:18Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Deepak Patankar writes:\n\n> I can use the \"ls-remote\", \"push --dry-run\" command you suggested, but\n> I have a use case which I don't know how to solve.\n> The above commands require a repository. In our application, the user\n> can give the following details\n>\n> Git Details:\n> Account URL: https://github.com/OpenPrinting\n> UserName: deepakpatankar\n> password: ***********\n>\n> In this case, we don't know the repo name. At this step, I just know\n> the account and the credentials of the user, later on\n> the user will provide me with the repo name to which he wants to sync his file.\n>\n> Since I don't know the repository, I cannot do \"git fetch\" or \"git\n> push --dry-run\". Can I check this credentials with some\n> logic or git commands?\n\nYou'd have to go outside Git, as our transport layer is only about\ntalking with existing repositories. You cannot even create a new \nrepository using Git native methods.\n\nYou may need to find a method that works with GitHub account (note\nthat I am not even using the word repository here, instead saying\n\"account\") and such a method would likely have to involve GitHub\nspecific API, but it probably would not work with other hosting\nproviders.\n\nI also would imagine that even at GitHub, one may want to use\ndifferent authentication info depending on which repository one\naccesses, so the \"there is a single User with a password at this\nhosting site\" data model might turn out to be insufficient, but\nthat is outside the scope of Git proper.\n\n\n"}]}