Re: OAuth2 support in git?

From: brian m. carlson <sandals@crustytoothpaste.net>
Date: Jun 14, 2018, 22:20 UTC
Message-ID: <20180614222000.GA622873@genre.crustytoothpaste.net>
In-Reply-To: <20180614151507.GA6933@sigill.intra.peff.net>

On Thu, Jun 14, 2018 at 11:15:07AM -0400, Jeff King wrote:

Show 9 quoted lines

> On Thu, Jun 14, 2018 at 10:13:42AM +0000, brian m. carlson wrote:
> > There isn't any support for Bearer authentication in Git.  For HTTP, we
> > use libcurl, which doesn't provide this natively.  While it could in
> > theory be added, it would require some reworking of the auth code.
> > 
> > You are, of course, welcome to send a patch.
> 
> If it's just a custom Authorization header, we should be able to support
> it with existing curl versions without _too_ much effort.

It shouldn't be too difficult, but we have some fallback among various authentication types that would need reworking.

Show 12 quoted lines

> I think there are probably two possible directions:
> 
>  1. add a special "bearer" command line option, etc, as a string
> 
>  2. add a boolean option to send the existing "password" field as a
>     "bearer" header
> 
> I suspect (2) would fit in with the existing code better, as the special
> case would mostly be limited to the manner in which we feed the
> credential to curl. And you could probably just set a config option for
> "this url's auth will be oauth2", and use the existing mechanisms for
> providing the password.

I agree option (2) would be better.

-- 
brian m. carlson: Houston, Texas, US
OpenPGP: https://keybase.io/bk2204