Re: [REGRESSION 2.10.2] problematic "empty auth" changes
- From
Johannes Schindelin <johannes.schindelin@gmx.de>
- Date
- Dec 10, 2016, 14:52 UTC
- Message-ID
- <alpine.DEB.2.20.1612101551100.23160@virtualbox>
- In-Reply-To
- <20161209221854.re6qf3e5225wxvge@genre.crustytoothpaste.net>
Hi Brian,
On Fri, 9 Dec 2016, brian m. carlson wrote:
Show 18 quoted lines
> On Thu, Dec 08, 2016 at 04:12:32PM -0500, David Turner wrote: > > I know of no reason that shouldn't work. Indeed, it's what we use do > > internally. So far, nobody has reported problems. That said, we have > > exactly three sets of git servers that most users talk to (two > > different internal; and occasionally github.com for external stuff). > > So our coverage is not very broad. > > > > If you're going to do it, tho, don't just do it for Windows users -- > > do it for everyone. Plenty of Unix clients connect to Windows-based > > auth systems. > > Let me echo this. This would make Kerberos (and probably other forms of > SPNEGO) work out of the box, which would reduce a lot of confusion that > people have. > > I can confirm enabling http.emptyAuth works properly with Kerberos, > including with fallback to Basic, so I see no reason why we shouldn't do > it.
One of my colleagues offered a legitimate concern: it potentially adds another round-trip.
Do you happen to know whether regular HTTPS negotiation will have an extra round-trip if Kerberos is attempted, but we have to fall back to interactively prompt for (or use stored) credentials?
Ciao, Johannes