git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Supporting Kerberos auth over HTTP (mod_auth_kerb)

From
NNick <f99@2thebatcave.com>
Date
Feb 8, 2011, 17:07 UTC
Message-ID
<AANLkTimUJjUBkbjPeq4+bsnwGqxrmj61W5qZmGQNy6Ah@mail.gmail.com>

Has anyone gotten negotiable authentication to work with git over http using mod_auth_kerb on the server end? I am unable to get a git client to function correctly in this scenario. I am defining "correctly" as the following:

When a valid kerberos ticket is available, use that without prompting for credentials. If for some reason that fails, prompt for credentials and try again using HTTP basic auth.

If no valid kerberos ticket is available, prompt for credentials and try using HTTP basic auth.

So far the behavior I have been able to reproduce:

When 'KrbMethodNegotiate off' is set on the server, the git client will always prompt for username and password and use them. This is very intuitive from the user perspective, but does not take advantage of the kerberos ticket for single sign-on.

When 'KrbMethodNegotiate on' is set on the server, the git client will always prompt for username and password, but ignore them. If a valid kerberos ticket is available, the command will complete after any arbitrary text is entered into the username and password prompts. If a valid kerberos ticket is not available, the command will fail even if the correct username and password is entered.

Using some combinations of various git and curl versions and compile options will not even get that far, and respond immediately with a 401.

I have tried several different versions of git, including the latest 1.7.4. I have tried several different versions of curl, including the latest 7.12.3. I have tried several different curl compile-time configuration options, including --with-spenego (using fbopenssl) and --with-gssapi.

Message 1 of 1 in “Supporting Kerberos auth over HTTP (mod_auth_kerb)”
  1. NickFeb 8, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.