mbox series

[0/3] Allow configuration of HTTP authentication method

Message ID 20220513070416.37235-1-Simon.Richter@hogyros.de (mailing list archive)
Headers show
Series Allow configuration of HTTP authentication method | expand


Simon.Richter@hogyros.de May 13, 2022, 7:04 a.m. UTC
From: Simon Richter <Simon.Richter@hogyros.de>


this adds a configuration option to set the authentication method curl uses
when authenticating to a server.

The method is always configured, not just when a username is set, to allow
failing early if the server does not support the selected method;
otherwise, this mechanism is orthogonal to the proxy authentication method
handling, and I've liberally copied code from there.

This introduces http.authmethod and remote.<name>.authmethod configuration
options and an environment variable GIT_HTTP_AUTHMETHOD, with ascending

There are three patches in this series, one that just renames a constant
list of options as it is used outside the proxy configuration scope now,
one that contains the main patch, and one I'm unsure about (hence no
Signed-Off-By yet) that allows empty user names during authentication.

The latter avoids surprises when people half-follow Microsoft's
documentation, which suggests that users configure a custom header
containing a hand-crafted Basic authentication string with an empty user
name. This is not strictly required by the "DevOps" server, any string will
do here, but simply pressing return on the username prompt will otherwise
fail to present the credentials at all, and give an error message
indicating that the given token is invalid.

I haven't investigated fully whether this is of any use outside the
interactive case, so the third patch is more of a request for comments.

With these changes, I can successfully authenticate to MS DevOps server
over HTTP using a Personal Access Token, without using the custom header
workaround[1], which allows me to use git-lfs (which in turn doesn't work
over ssh) from Jenkins with a limited token that is stored in the Jenkins
credential store, solving a problem for approximately tens of users[2].


[1] https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows#use-a-pat

[2] https://stackoverflow.com/q/64800010

Simon Richter (3):
  Rename proxy_authmethods -> authmethods
  Add config option/env var to limit HTTP auth methods
  Allow empty user name in HTTP authentication

 Documentation/config/http.txt   | 19 ++++++++++++++
 Documentation/config/remote.txt |  4 +++
 http.c                          | 45 ++++++++++++++++++++++++++++-----
 remote.c                        |  4 +++
 remote.h                        |  3 +++
 5 files changed, 68 insertions(+), 7 deletions(-)