Re: [PATCH] remote-curl: don't fall back to Basic auth if we haven't tried Negotiate

From: Dmitry Vilkov <dmitry.a.vilkov@gmail.com>
Date: Feb 5, 2016, 09:18 UTC
Message-ID: <CAHdYDCqtNQMoU3Gu2AcSEWM5wA0SbaMrivu3WV_-N+B-F67v1Q@mail.gmail.com>
In-Reply-To: <20160202232952.GA6503@vauxhall.crustytoothpaste.net>

2016-02-03 2:29 GMT+03:00 brian m. carlson <sandals@crustytoothpaste.net>:

Show 10 quoted lines

> I'm unclear in what case you'd need to have a username and password
> combination with GSS-Negotiate.  Kerberos doesn't use your password,
> although you need some indication of a username (valid or not) to get
> libcurl to do authentication.
>
> Are you basically using a bare URL (without a username component) and
> waiting for git to prompt you for the username, so that it will then
> enable authentication?  If so, this patch looks fine for that, although
> I'd expand on the commit message.  If not, could you provide an example
> of what you're trying to do?

You are right, we are using a bare URL (without a username component). With username encoded in URL everything works just fine. But it's generally wrong to pass creds in URL (in my opinion) and security policy of my employer prohibits doing such thing. Anyway, as you said libcurl needs valid (not NULL) username/password to do GSS-Negotiate, so there is nothing wrong if I set empty username/password combination when git prompts for creds. Even more, there is no other way to let libcurl to use GSS-Negotiate without username in URL.