git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Git over HTTP; have flexible SASL authentication

From
Junio C Hamano <gitster@pobox.com>
Date
Feb 6, 2023, 22:08 UTC
Message-ID
<xmqqk00u4fco.fsf@gitster.g>
In-Reply-To
<20230204113408.GD21507@openfortress.nl>
Rick van Rein <rick@openfortress.nl> writes:
> SASL assumes that the endpoints can hold state and progress through any
> challenge/response exchange, in multiple steps if needed.  This is not
> trivial with stateless HTTP, but we fixed it with a "s2s" argument which
> can hold the (datestamped, signed, encrypted) state on the server side.

That's nice to know, and its applications below do look useful, at least to me.

Show 12 quoted lines
> A few mechanisms that spring to mind as useful with Git over HTTP-SASL are
>
>  - Kerberos / GSS-API, desirable for companies using its single sign-on
>  _ FIDO, currently being added to SASL to benefit all protocols
>  - OPAQUE, a very modern crypto, developed in IETF now
>  - SXOVER-PLUS, our own work that calls back to a user's domain for login
> 	(so no server-stored credentials needed, only access control)
>
> I'm curious if this would indeed be considered an improvement to Git.
>
> Cheers,
>  -Rick
Previous: Rick van Rein
Message 6 of 6 in “Git over HTTP; have flexible SASL authentication”
  1. Rick van ReinJan 27, 2023
  2. Junio C HamanoJan 27, 2023
  3. Jeff KingFeb 1, 2023
  4. Matthew John CheethamFeb 1, 2023
  5. Rick van ReinFeb 4, 2023
  6. Junio C HamanoFeb 6, 2023

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.