Re: [PATCH] remote-curl: don't fall back to Basic auth if we haven't tried Negotiate

From: Junio C Hamano <gitster@pobox.com>
Date: Feb 5, 2016, 21:52 UTC
Message-ID: <xmqq60y2dduw.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <20160205210623.GC7403@vauxhall.crustytoothpaste.net>

"brian m. carlson" <sandals@crustytoothpaste.net> writes:

Show 14 quoted lines

> On Fri, Feb 05, 2016 at 01:02:58PM -0800, Junio C Hamano wrote:
>> Hmph, so documenting that <emptyname>:<emptypassword>@<repository>
>> as a supported way might be an ugly-looking solution to the original
>> problem.  A less ugly-looking solution might be a boolean that can
>> be set per URL (we already have urlmatch-config infrastructure to
>> help us do so) to tell us to pass the empty credential to lubCurl,
>> bypassing the step to ask the user for password that we do not use.
>> 
>> The end-result of either of these solution would strictly be better
>> than the patch we discussed in that the end user will not have to
>> interact with the prompt at all, right?
>
> Yes, that's true.  I'll try to come up with a patch this weekend that
> implements that (maybe remote.forceAuth = true or somesuch).

Thanks.

I think the configuration should live inside http.* namespace, as there are already things like http[.<url>].sslCert and friends.

I do not have a good suggestion on the name of the leaf-level variable. ForceAuth sounds as if you are forcing authentication even when the other side does not require it, though.