From: Matthew John Cheetham via GitGitGadget Date: Thu, 30 Apr 2026 10:54:28 GMT Subject: [PATCH v2 0/4] http: fix emptyAuth=auto for Negotiate/SPNEGO Message-ID: In-Reply-To: When a server advertises Negotiate (SPNEGO) authentication alongside Basic, the "auto" mode of http.emptyAuth should allow libcurl to attempt Kerberos authentication using the system ticket cache before falling back to credential_fill(). Currently this never happens due to an interaction between two older features. The Negotiate-stripping logic from 4dbe66464b (remote-curl: fall back to Basic auth if Negotiate fails, 2015-01-08) removes CURLAUTH_GSSNEGOTIATE on the first 401, before the auto-detection from 40a18fc77c (http: add an "auto" mode for http.emptyauth, 2017-02-25) gets a chance to see it as an "exotic" method. The result is that auto mode silently degrades to the same behavior as emptyAuth=false for any server whose only non-Basic/Digest method is Negotiate, forcing Kerberos users to manually set http.emptyAuth=true to get seamless ticket-based authentication. This series fixes the interaction by delaying the Negotiate stripping in auto mode by one round-trip, giving empty auth a chance to use the system Kerberos ticket. If there is no valid ticket, Negotiate is stripped on the second 401 and we fall through to credential_fill() as before. The true and false modes are unchanged. Patch 1: Extract a http_reauth_prepare() helper from the three retry paths that call credential_fill() on HTTP_REAUTH. Pure refactor, no behavior change. Patch 2: Delay the GSSNEGOTIATE stripping in auto mode and teach http_reauth_prepare() to skip credential_fill() when empty auth should be attempted first. Patch 3: Add tests verifying that auto mode produces an extra round-trip (empty auth attempt) compared to false mode, using the existing nph-custom-auth.sh CGI infrastructure. Patch 4: Update http.emptyAuth documentation to clarify possible values (true, false, and auto). There is a trade-off in auto mode: when a server advertises Negotiate but the client has no valid Kerberos ticket, there is one extra round-trip compared to the current behavior. This matches the trade-off already documented in 40a18fc77c. Users who want to avoid it can set http.emptyAuth=false. Note: this patch series was taken early into Git for Windows for the 2.54.0-rc2 release. https://github.com/git-for-windows/git/commit/8e94b65c003783d7d7b09d9fccdf06a1363e347c ---------------------------------------------------------------------------- Update in v2: * Add patch 4 to clarify the available options for http.emptyAuth in the config documentation. Matthew John Cheetham (4): http: extract http_reauth_prepare() from retry paths http: attempt Negotiate auth in http.emptyAuth=auto mode t5563: add tests for http.emptyAuth with Negotiate doc: clarify http.emptyAuth values Documentation/config/http.adoc | 13 +++++- http.c | 32 ++++++++++++++- http.h | 6 +++ remote-curl.c | 4 +- t/t5563-simple-http-auth.sh | 74 ++++++++++++++++++++++++++++++++++ 5 files changed, 124 insertions(+), 5 deletions(-) base-commit: 2b39a27d40682c09ac1c031f099ee602061597cd Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2087%2Fmjcheetham%2Fspnego-fix-upstream-v2 Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2087/mjcheetham/spnego-fix-upstream-v2 Pull-Request: https://github.com/gitgitgadget/git/pull/2087 Range-diff vs v1: 1: 49488cc7d4 = 1: 49488cc7d4 http: extract http_reauth_prepare() from retry paths 2: f175294459 = 2: f175294459 http: attempt Negotiate auth in http.emptyAuth=auto mode 3: 650acab79e = 3: 650acab79e t5563: add tests for http.emptyAuth with Negotiate -: ---------- > 4: e0f236767f doc: clarify http.emptyAuth values -- gitgitgadget