Re: forcing a user@ into the URL if not present

From: Dan Langille <dlangille@sourcefire.com>
Date: May 4, 2015, 19:35 UTC
Message-ID: <CABU7BdcuJp3f6_cN8TpJX-brDUWL6-0Q5M0Yvpg2ND-k--yEbw@mail.gmail.com>
In-Reply-To: <20150430202342.GC5015@vauxhall.crustytoothpaste.net>

On Thu, Apr 30, 2015 at 4:23 PM, brian m. carlson <sandals@crustytoothpaste.net> wrote:

Show 49 quoted lines

> On Thu, Apr 30, 2015 at 04:14:12PM -0400, Dan Langille wrote:
>> Would this question be better suited for another list?
>
> Nope, this is the place to go.
>
>> On Wed, Apr 22, 2015 at 4:06 PM, Dan Langille <dlangille@sourcefire.com> wrote:
>> > Hello,
>> >
>> > I'm using git 2.3.2 with Kerberos for authentication and gito-lite for
>> > authorization.
>> >
>> > This works:
>> >
>> > $ git clone https://dvl@ repo.example.org/git/testing
>> > Cloning into 'testing'...
>> > warning: You appear to have cloned an empty repository.
>> > Checking connectivity... done.
>> >
>> > My goal: have it work without supplying dvl@ as shown here:
>> >
>> > $ git clone https://repo.example.org/git/testing
>> > Cloning into 'testing'...
>> > Username for 'https://repo.example.org':
>> >
>> > I don't want to be prompted for a password.  I want Kerberos to kick in.
>> >
>> > Following http://git-scm.com/docs/gitcredentials, the following seems to
>> > have nil effect.  Anyone used this feature already?
>> >
>> >   git config --global credential.https://repo.example.org.username dvl
>> >
>> > $ cat ~/.gitconfig
>> > [credential "https://repo.example.org"]
>> > username = dvl
>> > [http]
>> > sslCAInfo = /usr/local/etc/trusted-certificates.pem
>> >
>> > With the above, I still get prompted for a password
>> >
>> > Given my use of Kerberos for authorization, is this option feasible?
>
> Not at the present time.  The only time that the credential API is
> invoked is if it prompts for a password, and by that point you've fallen
> back to Basic authentication.
>
>> > Should I be taking a different approach?
>
> If you want it to work only with Kerberos, then any username in the URL
> is fine, as libcurl doesn't care.

That is what I found during testing. So long as I put a username in the URL, Kerberos worked and all authentication occurred as expected.

Show 7 quoted lines

>> One thing you could try is to make your URL https://git@repo.example.org
> and then use
>
>   git config --global credential.https://git@repo.example.org.username dvl
>
> and see if it does the right thing for both Kerberos and Basic auth.  It
> would be sort of a hack, but it might work.

It asks for a password, and for the correct user:

Password for 'https://dvl@repo.example.org':

Thanks Brian, for this, and your other help.  I appreciate it.

-- 
Dan Langille
Infrastructure & Operations
Talos Group
Sourcefire, Inc.