git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [REGRESSION 2.10.2] problematic "empty auth" changes

From
Johannes Schindelin <johannes.schindelin@gmx.de>
Date
Dec 10, 2016, 14:52 UTC
Message-ID
<alpine.DEB.2.20.1612101551100.23160@virtualbox>
In-Reply-To
<20161209221854.re6qf3e5225wxvge@genre.crustytoothpaste.net>
Hi Brian,
On Fri, 9 Dec 2016, brian m. carlson wrote:
Show 18 quoted lines
> On Thu, Dec 08, 2016 at 04:12:32PM -0500, David Turner wrote:
> > I know of no reason that shouldn't work.  Indeed, it's what we use do
> > internally.  So far, nobody has reported problems.  That said, we have
> > exactly three sets of git servers that most users talk to (two
> > different internal; and occasionally github.com for external stuff).
> > So our coverage is not very broad.
> > 
> > If you're going to do it, tho, don't just do it for Windows users --
> > do it for everyone.  Plenty of Unix clients connect to Windows-based
> > auth systems.
> 
> Let me echo this.  This would make Kerberos (and probably other forms of
> SPNEGO) work out of the box, which would reduce a lot of confusion that
> people have.
> 
> I can confirm enabling http.emptyAuth works properly with Kerberos,
> including with fallback to Basic, so I see no reason why we shouldn't do
> it.

One of my colleagues offered a legitimate concern: it potentially adds another round-trip.

Do you happen to know whether regular HTTPS negotiation will have an extra round-trip if Kerberos is attempted, but we have to fall back to interactively prompt for (or use stored) credentials?

Ciao, Johannes

Previous: brian m. carlsonNext: brian m. carlson
Message 6 of 7 in “[REGRESSION 2.10.2] problematic "empty auth" changes”
  1. Johannes SchindelinDec 8, 2016
  2. David TurnerDec 8, 2016
  3. Johannes SchindelinDec 9, 2016
  4. Junio C HamanoDec 9, 2016
  5. brian m. carlsonDec 9, 2016
  6. Johannes SchindelinDec 10, 2016
  7. brian m. carlsonDec 10, 2016

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.