mirror of
https://github.com/git/git
synced 2024-08-28 20:20:07 +00:00
37417b7717
Some HTTP authentication schemes, such as NTLM- and Kerberos-based options, require more than one round trip to authenticate. Currently, these can only be supported in libcurl, since Git does not have support for this in the credential helper protocol. However, in a future commit, we'll add support for this functionality into the credential helper protocol and Git itself. Because we don't really want to implement either NTLM or Kerberos, both of which are complex protocols, we'll want to test this using a fake credential authentication scheme. In order to do so, update t5563 and its backend to allow us to accept multiple sets of credentials and respond with different behavior in each case. Since we can now provide any number of possible status codes, provide a non-specific reason phrase so we don't have to generate a more specific one based on the response. The reason phrase is mandatory according to the status-line production in RFC 7230, but clients SHOULD ignore it, and curl does (except to print it). Each entry in the authorization and challenge fields contains an ID, which indicates a corresponding credential and response. If the response is a 200 status, then we continue to execute git-http-backend. Otherwise, we print the corresponding status and response. If no ID is matched, we use the default response with a status of 401. Note that there is an implicit order to the parameters. The ID is always first and the creds or response value is always last, and therefore may contain spaces, equals signs, or other arbitrary data. Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
49 lines
1.6 KiB
Bash
49 lines
1.6 KiB
Bash
#!/bin/sh
|
|
|
|
VALID_CREDS_FILE=custom-auth.valid
|
|
CHALLENGE_FILE=custom-auth.challenge
|
|
|
|
#
|
|
# If $VALID_CREDS_FILE exists in $HTTPD_ROOT_PATH, consider each line as a valid
|
|
# credential for the current request. Each line in the file is considered a
|
|
# valid HTTP Authorization header value. For example:
|
|
#
|
|
# Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
|
|
#
|
|
# If $CHALLENGE_FILE exists in $HTTPD_ROOT_PATH, output the contents as headers
|
|
# in a 401 response if no valid authentication credentials were included in the
|
|
# request. For example:
|
|
#
|
|
# WWW-Authenticate: Bearer authorize_uri="id.example.com" p=1 q=0
|
|
# WWW-Authenticate: Basic realm="example.com"
|
|
#
|
|
|
|
if test -n "$HTTP_AUTHORIZATION" && \
|
|
grep -Fqs "creds=${HTTP_AUTHORIZATION}" "$VALID_CREDS_FILE"
|
|
then
|
|
idno=$(grep -F "creds=${HTTP_AUTHORIZATION}" "$VALID_CREDS_FILE" | sed -e 's/^id=\([a-z0-9-][a-z0-9-]*\) .*$/\1/')
|
|
status=$(sed -ne "s/^id=$idno.*status=\\([0-9][0-9][0-9]\\).*\$/\\1/p" "$CHALLENGE_FILE" | head -n1)
|
|
# Note that although git-http-backend returns a status line, it
|
|
# does so using a CGI 'Status' header. Because this script is an
|
|
# No Parsed Headers (NPH) script, we must return a real HTTP
|
|
# status line.
|
|
# This is only a test script, so we don't bother to check for
|
|
# the actual status from git-http-backend and always return 200.
|
|
echo "HTTP/1.1 $status Nonspecific Reason Phrase"
|
|
if test "$status" -eq 200
|
|
then
|
|
exec "$GIT_EXEC_PATH"/git-http-backend
|
|
else
|
|
sed -ne "s/^id=$idno.*response=//p" "$CHALLENGE_FILE"
|
|
echo
|
|
exit
|
|
fi
|
|
fi
|
|
|
|
echo 'HTTP/1.1 401 Authorization Required'
|
|
if test -f "$CHALLENGE_FILE"
|
|
then
|
|
sed -ne 's/^id=default.*response=//p' "$CHALLENGE_FILE"
|
|
fi
|
|
echo
|