Re: Git + mod_auth_kerb

From: brian m. carlson <sandals@crustytoothpaste.net>
Date: Jul 23, 2014, 01:59 UTC
Message-ID: <20140723015955.GF5616@vauxhall.crustytoothpaste.net>
In-Reply-To: <CAPYmS36r2fTeY4iB3k7VpgE7brAGxa+wt9HzfXtMStbMW4_Xvg@mail.gmail.com>

On Tue, Jul 22, 2014 at 12:41:19PM -0400, Jean-Francois Bouchard wrote:

> Thanks for this info. This make a lot of sense system wise. For a user
> point of view, it is a nightmare. Also, this break a lot of tools that
> are waiting username/password authentication via HTTPS. (I name
> Eclipse).

What you may want to do is have each user adjust their .gitconfig to do something like:

  [url "https://bmc@git.crustytoothpaste.net/"]
    insteadOf = https://git.crustytoothpaste.net/

That way, everyone can continue to use the same URLs, but have git fix them up per-user.

Hopefully I'll get some time this week to see if making HTTPS requests provide an empty username by default will work.

> Also, I m not able to reproduce the kerberos login on Ubuntu 14.04. I
> m asked to enter password even if a kerberos ticket is present and
> this even when I've embedded the username in the URI.

This sounds like an issue with Kerberos and curl on Ubuntu 14.04. I'm using Debian unstable (from which Ubuntu pulls changes), and at no point have I had this problem. Can you send us the output of the push with the environment GIT_CURL_VERBOSE set to 1 on a system where it works and one where it doesn't?

> Is there a better way to integrate Kerberos via HTTPS for git ?

I don't know of any better way. It does work for me, although I'm just one person.

-- 
brian m. carlson / brian with sandals: Houston, Texas, US
+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187