http: add option to try authentication without username
Performing GSS-Negotiate authentication using Kerberos does not require specifying a username or password, since that information is already included in the ticket itself. However, libcurl refuses to perform authentication if it has not been provided with a username and password. Add an option, http.emptyAuth, that provides libcurl with an empty username and password to make it attempt authentication anyway. Signed-off-by: Junio C Hamano <gitster@pobox.com>
brian m. carlson committed
Feb 15, 2016 at 18:44 UTC
121061f67fd47aed5b2f3a7deb82af15215636bd
2 files changed
+17
-2
Documentation/config.txt
+6
@@ -1600,6 +1600,12 @@ http.proxy::
1600
`curl(1)`). This can be overridden on a per-remote basis; see
1601
remote.<name>.proxy
1602
1603
+http.emptyAuth::
1604
+ Attempt authentication without seeking a username or password. This
1605
+ can be used to attempt GSS-Negotiate authentication without specifying
1606
+ a username in the URL, as libcurl normally requires a username for
1607
+ authentication.
1608
+
1609
http.cookieFile::
1610
File containing previously stored cookie lines which should be used
1611
in the Git http session, if they match the server. The file format
http.c
+11
-2
@@ -67,6 +67,7 @@ static int curl_save_cookies;
67
struct credential http_auth = CREDENTIAL_INIT;
68
static int http_proactive_auth;
69
static const char *user_agent;
70
+static int curl_empty_auth;
71
72
#if LIBCURL_VERSION_NUM >= 0x071700
73
/* Use CURLOPT_KEYPASSWD as is */
@@ -273,14 +274,22 @@ static int http_options(const char *var, const char *value, void *cb)
274
if (!strcmp("http.useragent", var))
275
return git_config_string(&user_agent, var, value);
276
277
+ if (!strcmp("http.emptyauth", var)) {
278
+ curl_empty_auth = git_config_bool(var, value);
279
+ return 0;
280
+ }
281
+
282
/* Fall back on the default ones */
283
return git_default_config(var, value, cb);
284
}
285
286
static void init_curl_http_auth(CURL *result)
287
{
282
- if (!http_auth.username)
288
+ if (!http_auth.username) {
289
+ if (curl_empty_auth)
290
+ curl_easy_setopt(result, CURLOPT_USERPWD, ":");
291
return;
292
+ }
293
294
credential_fill(&http_auth);
295
@@ -695,7 +704,7 @@ struct active_request_slot *get_active_slot(void)
704
#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY
705
curl_easy_setopt(slot->curl, CURLOPT_HTTPAUTH, http_auth_methods);
706
#endif
698
- if (http_auth.password)
707
+ if (http_auth.password || curl_empty_auth)
708
init_curl_http_auth(slot->curl);
709
710
return slot;