From: Dmitry Vilkov <dmitry.a.vilkov@gmail.com>
Date: Mon, 08 Feb 2016 09:11:57 GMT
Subject: Re: [PATCH] remote-curl: don't fall back to Basic auth if we haven't tried Negotiate
Message-ID: <CAHdYDCq+MiAJoCPFd3Qn9VjAzoii8QgTOOV7HXEV8OdzW-dgPQ@mail.gmail.com>
In-Reply-To: <xmqq60y2dduw.fsf@gitster.mtv.corp.google.com>

2016-02-06 0:52 GMT+03:00 Junio C Hamano <gitster@pobox.com>:
> "brian m. carlson" <sandals@crustytoothpaste.net> writes:
>
>> On Fri, Feb 05, 2016 at 01:02:58PM -0800, Junio C Hamano wrote:
>>> Hmph, so documenting that <emptyname>:<emptypassword>@<repository>
>>> as a supported way might be an ugly-looking solution to the original
>>> problem.  A less ugly-looking solution might be a boolean that can
>>> be set per URL (we already have urlmatch-config infrastructure to
>>> help us do so) to tell us to pass the empty credential to lubCurl,
>>> bypassing the step to ask the user for password that we do not use.
>>>
>>> The end-result of either of these solution would strictly be better
>>> than the patch we discussed in that the end user will not have to
>>> interact with the prompt at all, right?
>>
>> Yes, that's true.  I'll try to come up with a patch this weekend that
>> implements that (maybe remote.forceAuth = true or somesuch).
>
> Thanks.
>
> I think the configuration should live inside http.* namespace, as
> there are already things like http[.<url>].sslCert and friends.
>
> I do not have a good suggestion on the name of the leaf-level
> variable.  ForceAuth sounds as if you are forcing authentication
> even when the other side does not require it, though.

That would be great! Definitely it will be much better solution than
patch I've proposed.