Re: [PATCH] remote-curl: don't fall back to Basic auth if we haven't tried Negotiate

From: brian m. carlson <sandals@crustytoothpaste.net>
Date: Feb 5, 2016, 20:58 UTC
Message-ID: <20160205205835.GB7403@vauxhall.crustytoothpaste.net>
In-Reply-To: <xmqq60y3dout.fsf@gitster.mtv.corp.google.com>

On Fri, Feb 05, 2016 at 09:54:50AM -0800, Junio C Hamano wrote:

> OK, as Brian said, that use case would need to be in the log
> message, at least.  I am curious, though, if you can give just a
> random string to username, or at least that must match what the
> underlying authentication mechanism uses.

You can give any invalid credentials you like. When using Kerberos, the provided username and password are ignored, because all the authentication information is in the ticket, and it's all encrypted.

I'm happy to send a documentation patch for this, as it seems to come up a lot.

> Brian, I can see how this would work in that use case, but I haven't
> convinced myself that the change would not affect other existing use
> cases that are supported--do you think of any that would negatively
> affect the user expeerience?

I'd have to test how it works with Basic auth as a fallback. I don't normally use that on my servers, so I'd have to enable it and try it out.

-- 
brian m. carlson / brian with sandals: Houston, Texas, US
+1 832 623 2791 | https://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187