[PATCH 0/3] Allow configuration of HTTP authentication method

From: Simon Richter <Simon.Richter@hogyros.de>

Hi,

this adds a configuration option to set the authentication method curl uses when authenticating to a server.

The method is always configured, not just when a username is set, to allow failing early if the server does not support the selected method; otherwise, this mechanism is orthogonal to the proxy authentication method handling, and I've liberally copied code from there.

This introduces http.authmethod and remote.<name>.authmethod configuration options and an environment variable GIT_HTTP_AUTHMETHOD, with ascending precedence.

There are three patches in this series, one that just renames a constant list of options as it is used outside the proxy configuration scope now, one that contains the main patch, and one I'm unsure about (hence no Signed-Off-By yet) that allows empty user names during authentication.

The latter avoids surprises when people half-follow Microsoft's documentation, which suggests that users configure a custom header containing a hand-crafted Basic authentication string with an empty user name. This is not strictly required by the "DevOps" server, any string will do here, but simply pressing return on the username prompt will otherwise fail to present the credentials at all, and give an error message indicating that the given token is invalid.

I haven't investigated fully whether this is of any use outside the interactive case, so the third patch is more of a request for comments.

With these changes, I can successfully authenticate to MS DevOps server over HTTP using a Personal Access Token, without using the custom header workaround[1], which allows me to use git-lfs (which in turn doesn't work over ssh) from Jenkins with a limited token that is stored in the Jenkins credential store, solving a problem for approximately tens of users[2].

   Simon

[1] https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows#use-a-pat

[2] https://stackoverflow.com/q/64800010

Simon Richter (3):
  Rename proxy_authmethods -> authmethods
  Add config option/env var to limit HTTP auth methods
  Allow empty user name in HTTP authentication

 Documentation/config/http.txt   | 19 ++++++++++++++
 Documentation/config/remote.txt |  4 +++
 http.c                          | 45 ++++++++++++++++++++++++++++-----
 remote.c                        |  4 +++
 remote.h                        |  3 +++
 5 files changed, 68 insertions(+), 7 deletions(-)