Re: [PATCH] remote-curl: don't fall back to Basic auth if we haven't tried Negotiate

From: Daniel Stenberg <daniel@haxx.se>
Date: Feb 6, 2016, 17:53 UTC
Message-ID: <alpine.DEB.2.20.1602061850460.4476@tvnag.unkk.fr>
In-Reply-To: <xmqq60y3dout.fsf@gitster.mtv.corp.google.com>

On Fri, 5 Feb 2016, Junio C Hamano wrote:

Show 15 quoted lines

> OK, as Brian said, that use case would need to be in the log message, at 
> least.  I am curious, though, if you can give just a random string to 
> username, or at least that must match what the underlying authentication 
> mechanism uses.
>
> Brian, I can see how this would work in that use case, but I haven't 
> convinced myself that the change would not affect other existing use cases 
> that are supported--do you think of any that would negatively affect the 
> user expeerience?
>
>> Even more, there is no other way to let libcurl to use GSS-Negotiate 
>> without username in URL.
>
> Asking lubcurl expert about that might not be a bad idea; Cc'ed Daniel 
> Stenberg.

It is correct that libcurl needs a username to trigger the use of HTTP authentication - any HTTP authentication - due to how we once designed the internals for this - but when using GSS-Negotiate the actually provided user name isn't used by libcurl for anything so it could be a fixed string or random junk, it doesn't matter as long as a name is provided.

-- 
  / daniel.haxx.se