Bazaar should attempt Basic authentication if HTTP server offers NTLM

On Fri, 2009-04-24 at 14:02 +0000, Daniel Cassidy wrote:
>
>
> I suggest attempting Basic authentication as a fallback if NTLM is
> offered. I’m reporting this as a Bazaar bug rather than a bzr-svn bug
> because the problem seems to be with Bazaar itself.

Its up to web servers to list what authentication methods they support -
if your server lists basic as a supported means, and bzr is bugfree in
this regard :P, then we would use it.

However, I suspect the issue here is unrelated to NTLM vs Basic -
however, Vincent knows our http stack's issue rather better than I, so
I'll let him comment further.

-Rob

2009/4/26 Robert Collins <email address hidden>:
> Its up to web servers to list what authentication methods they support -
> if your server lists basic as a supported means, and bzr is bugfree in
> this regard :P, then we would use it.

It is offering Basic but Bazaar isn't attempting to use it. Perhaps
you're right and this isn't NTLM related. I jumped to that conclusion
because old versions of a certain SVN implementation get confused by
the offer of NTLM and have to be forced to use Basic instead.

It looks like the server is presenting both NTLM and Basic as possible auth schemes, so either our NTLM handling is bogus or our overall auth scheme is, I'll look into that.

Also, you just compromised your login/password, you didn't obfuscate the logs well enough so you may want to change your password (it looks like a good and strong one (too many caps for my taste though), but I know it now...).

@Daniel: I deleted the logs but that may not be enough to protect your password.

Oops, well spotted. Well, no problem, I’ve changed it.

Fixed in the associate branch, feedback welcome.

I know it's late but I just wanted to confirm that this is fixed in bzr 1.15 and working perfectly for me.

This is much appreciated -- thanks for fixing :).

For the record, the problem was that bzr was trying only the first proposed authentication scheme (NTLM here which isn't supported) without falling back to the other proposed schemes (Basic here which *is* supported).