git/list[1] front-page[2] threads[3] people[4] search[5] about
 

git-http-backend auth via Kerberos

From
DDDan Langille (dalangil) <dalangil@cisco.com>
Date
Dec 18, 2014, 22:19 UTC
Message-ID
<540A8740-B240-40FF-BB50-0D90DEA04031@cisco.com>
I am trying to get http://git-scm.com/docs/git-http-backend to auth via Kerberos.
I have success when a Kerberos ticket is present.
I am trying to get git to authenticate with Kerberos when a ticket is not present.
Here is what succeeds with a ticket:
<Location /git>
  SSLOptions +StdenvVars
  Options +ExecCGI +FollowSymLinks +SymLinksIfOwnerMatch
    # By default, allow access to anyone.
    Order allow,deny
    Allow from All
    # Enable Kerberos authentication using mod_auth_kerb.
    AuthType Kerberos
    AuthName “us.example.com"
    KrbAuthRealm us.example.com
    Krb5KeyTab /usr/local/etc/apache22/repo-test.keytab
    KrbMethodNegotiate on
    KrbSaveCredentials on
    KrbVerifyKDC on
    KrbServiceName Any
    Require valid-user
</Location>
This is what happens without a valid ticket:

$ git clone https://us.example.com/git/clamav-bytecode-compiler Cloning into 'clamav-bytecode-compiler'... Username for 'https://us.example.com': dan Password for 'https://dan@us.example.com': fatal: Authentication failed for 'https://us.example.com/git/clamav-bytecode-compiler/'

Of note, I see this in the Apache logs:
Thu Dec 18 16:43:35 2014] [debug] src/mod_auth_kerb.c(1749): [client 10.7.69.10] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
Ideas?  Suggestions?  Hints?  Thanks.

— Dan Langille Infrastructure & Operations Talos Group Sourcefire, Inc.

Next: brian m. carlson
Message 1 of 39 in “git-http-backend auth via Kerberos”
  1. Dan Langille (dalangil)Dec 18, 2014
  2. brian m. carlsonDec 18, 2014
  3. Dan Langille (dalangil)Dec 19, 2014
  4. Dan Langille (dalangil)Dec 19, 2014
  5. Dan Langille (dalangil)Dec 19, 2014
  6. brian m. carlsonDec 19, 2014
  7. Dan Langille (dalangil)Dec 19, 2014
  8. remote-curl: fall back to Basic auth if Negotiate fails.brian m. carlson, Dec 27, 2014
  9. Jeff KingDec 27, 2014
  10. brian m. carlsonDec 27, 2014
  11. Jeff KingDec 27, 2014
  12. brian m. carlsonDec 28, 2014
  13. remote-curl: fall back to Basic auth if Negotiate failsbrian m. carlson, Jan 1, 2015
  14. Jeff KingJan 3, 2015
  15. brian m. carlsonJan 3, 2015
  16. Jeff KingJan 3, 2015
  17. Dan Langille (dalangil)Jan 5, 2015
  18. Dan Langille (dalangil)Jan 5, 2015
  19. brian m. carlsonJan 5, 2015
  20. Dan Langille (dalangil)Jan 6, 2015
  21. Dan Langille (dalangil)Jan 6, 2015
  22. Dan Langille (dalangil)Jan 6, 2015
  23. brian m. carlsonJan 8, 2015
  24. remote-curl: fall back to Basic auth if Negotiate failsbrian m. carlson, Jan 8, 2015
  25. Dan Langille (dalangil)Jan 20, 2015
  26. Junio C HamanoJan 21, 2015
  27. Dan Langille (dalangil)Jan 22, 2015
  28. Dan Langille (dalangil)Feb 17, 2015
  29. Junio C HamanoFeb 17, 2015
  30. Dan Langille (dalangil)Feb 18, 2015
  31. brian m. carlsonFeb 19, 2015
  32. Dan Langille (dalangil)Feb 24, 2015
  33. Dan Langille (dalangil)Feb 25, 2015
  34. Dan Langille (dalangil)Mar 10, 2015
  35. brian m. carlsonMar 10, 2015
  36. Dan Langille (dalangil)Mar 11, 2015
  37. brian m. carlsonMar 11, 2015
  38. Dan Langille (dalangil)Mar 12, 2015
  39. Dan Langille (dalangil)Jan 5, 2015

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.