Re: GIT, libcurl and GSS-Negotiate

From: Carlos Martín Nieto <cmn@elego.de>
Date: May 12, 2014, 18:01 UTC
Message-ID: <1399917719.2595.5.camel@centaur.cmartin.tk>
In-Reply-To: <20140510210132.GD45511@vauxhall.crustytoothpaste.net>

On Sat, 2014-05-10 at 21:01 +0000, brian m. carlson wrote:

Show 21 quoted lines

> On Mon, May 05, 2014 at 12:21:33PM +0200, Ivo Bellin Salarin wrote:
> > Well, I'm on Windows.
> > using `git version 1.9.2.msysgit.0`.
> > 
> > You can find all the exchanges, recorded with wireshark, of the
> > following usecases:
> > * git vanilla (not working),
> > * VisualStudio2013 with libgit (working)
> > * curl (--ntlm, working)
> > * curl (--negotiate, not working)
> 
> Okay, so what it looks like is that for some reason, the server and
> libcurl refuse to connect with Negotiate authentication.  git uses
> CURLAUTH_ANY, and libcurl picks the best choice: Negotiate.  The
> difference between your setup and mine is that I'm using Negotiate with
> Kerberos 5, and you're using Negotiate with NTLM.
> 
> What it looks like is happening is that git is offering Negotiate data,
> and then your server is responding with a 401 Unauthorized.  libgit2
> (presumably using WinHTTP) continues in this case, retrying with a
> longer set of credential containing more data, but git gives up.

While libgit2 does use WinHTTP by default on Windows, Visual Studio overrides this and uses their own HTTP transport (which makes the .NET stack to handle it) because of the way the prefer to do things, with just the one persistent connection to TFS.

But details aside, the code Visual Studio uses to do authentication has nothing to do with any of the others.

cmn