@matheusbsbs / matheus-bagliano / commits / 4dbe66464b

remote-curl: fall back to Basic auth if Negotiate fails

Apache servers using mod_auth_kerb can be configured to allow the user to authenticate either using Negotiate (using the Kerberos ticket) or Basic authentication (using the Kerberos password). Often, one will want to use Negotiate authentication if it is available, but fall back to Basic authentication if the ticket is missing or expired. However, libcurl will try very hard to use something other than Basic auth, even over HTTPS. If Basic and something else are offered, libcurl will never attempt to use Basic, even if the other option fails. Teach the HTTP client code to stop trying authentication mechanisms that don't use a password (currently Negotiate) after the first failure, since if they failed the first time, they will never succeed. Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

brian m. carlson committed Jan 8, 2015 at 00:29 UTC 4dbe66464b4fd695c5989cc272fa0edd6475037c

1 file changed +10

http.c

+10

@@ -62,6 +62,9 @@ static const char *user_agent;

63 static struct credential cert_auth = CREDENTIAL_INIT;

64 static int ssl_cert_password_required;

65 +#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY

66 +static unsigned long http_auth_methods = CURLAUTH_ANY;

67 +#endif

69 static struct curl_slist *pragma_header;

70 static struct curl_slist *no_pragma_header;

@@ -580,6 +583,9 @@ struct active_request_slot *get_active_slot(void)

583 curl_easy_setopt(slot->curl, CURLOPT_UPLOAD, 0);

584 curl_easy_setopt(slot->curl, CURLOPT_HTTPGET, 1);

585 curl_easy_setopt(slot->curl, CURLOPT_FAILONERROR, 1);

586 +#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY

587 + curl_easy_setopt(slot->curl, CURLOPT_HTTPAUTH, http_auth_methods);

588 +#endif

589 if (http_auth.password)

590 init_curl_http_auth(slot->curl);

591

@@ -870,6 +876,9 @@ int handle_curl_result(struct slot_results *results)

876 credential_reject(&http_auth);

877 return HTTP_NOAUTH;

878 } else {

879 +#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY

880 + http_auth_methods &= ~CURLAUTH_GSSNEGOTIATE;

881 +#endif

882 return HTTP_REAUTH;

883 }

884 } else {

@@ -986,6 +995,7 @@ static void extract_content_type(struct strbuf *raw, struct strbuf *type,

995 strbuf_addstr(charset, "ISO-8859-1");

996 }

997

998 +

999 /* http_request() targets */

1000 #define HTTP_REQUEST_STRBUF 0

1001 #define HTTP_REQUEST_FILE 1