Re: Git over HTTP; have flexible SASL authentication

From: Jeff King <peff@peff.net>
Date: Feb 1, 2023, 11:24 UTC
Message-ID: <Y9pL0D2WuKqqwB7X@coredump.intra.peff.net>
In-Reply-To: <xmqq7cx7aov7.fsf@gitster.g>

On Fri, Jan 27, 2023 at 09:06:36AM -0800, Junio C Hamano wrote:

Show 10 quoted lines

> Rick van Rein <rick@openfortress.nl> writes:
> 
> > Git providers are inventing proprietary extensions to HTTP authentication
> > for Git.  It seems smarter to use SASL for this purpose, possibly allowing
> > the client a choice and authentication ringback to the client's own domain.
> 
> To adopt things like this, the work to extend how to make extensible
> what is on WWW-Authenticate in the thread that contains this recent
> message https://lore.kernel.org/git/Y9LvFMzriAWUsS58@coredump.intra.peff.net/
> may be relevant, perhaps?

It's relevant, but I think there's a ways to go. That is just about passing WWW-Authenticate headers to helpers, which can then try to make sense of them. But Git would still only understand getting back a username/password from the helper, and passing it along to curl. And hopefully we'd do it all through curl's SASL support, and not invent our own handling.

I'm not sure what all that might might look like. I'm sure Matthew has probably thought about it, so I'll let him say something more intelligent. :)

-Peff