@matheusbsbs / matheus-bagliano / commits / 7046f1d572

credential: add an authtype field

When Git makes an HTTP request, it can negotiate the type of authentication to use with the server provided the authentication scheme is one of a few well-known types (Basic, Digest, NTLM, or Negotiate). However, some servers wish to use other types of authentication, such as the Bearer type from OAuth2. Since libcurl doesn't natively support this type, it isn't possible to use it, and the user is forced to specify the Authorization header using the http.extraheader setting. However, storing a plaintext token in the repository configuration is not very secure, especially if a repository can be shared by multiple parties. We already have support for many types of secure credential storage by using credential helpers, so let's teach credential helpers how to produce credentials for an arbitrary scheme. If the credential helper specifies an authtype field, then it specifies an authentication scheme (e.g., Bearer) and the password field specifies the raw authentication token, with any encoding already specified. We reuse the password field for this because some credential helpers store the metadata without encryption even though the password is encrypted, and we'd like to avoid insecure storage if an older version of the credential helper gets ahold of the data. The username is not used in this case, but it is still preserved for the purpose of finding the right credential if the user has multiple accounts. If the authtype field is not specified, then the password behaves as normal and it is passed along with the username to libcurl. Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

brian m. carlson committed Apr 17, 2024 at 00:02 UTC 7046f1d57240b6eb39af22c024d6fec4a6cfcb5d

2 files changed +11

credential.c

@@ -26,6 +26,7 @@ void credential_clear(struct credential *c)

26 free(c->username);

27 free(c->password);

28 free(c->oauth_refresh_token);

29 + free(c->authtype);

30 string_list_clear(&c->helpers, 0);

31 strvec_clear(&c->wwwauth_headers);

@@ -252,6 +253,9 @@ int credential_read(struct credential *c, FILE *fp)

253 } else if (!strcmp(key, "oauth_refresh_token")) {

254 free(c->oauth_refresh_token);

255 c->oauth_refresh_token = xstrdup(value);

256 + } else if (!strcmp(key, "authtype")) {

257 + free(c->authtype);

258 + c->authtype = xstrdup(value);

259 } else if (!strcmp(key, "url")) {

260 credential_from_url(c, value);

261 } else if (!strcmp(key, "quit")) {

@@ -295,6 +299,7 @@ void credential_write(const struct credential *c, FILE *fp)

299 }

300 for (size_t i = 0; i < c->wwwauth_headers.nr; i++)

301 credential_write_item(fp, "wwwauth[]", c->wwwauth_headers.v[i], 0);

302 + credential_write_item(fp, "authtype", c->authtype, 0);

303 }

304

305 static int run_credential_helper(struct credential *c,

credential.h

@@ -143,6 +143,12 @@ struct credential {

143 char *path;

144 char *oauth_refresh_token;

145 timestamp_t password_expiry_utc;

146 +

147 + /**

148 + * The authorization scheme to use. If this is NULL, libcurl is free to

149 + * negotiate any scheme it likes.

150 + */

151 + char *authtype;

152 };

153

154 #define CREDENTIAL_INIT { \