Re: [RFC] Adding a challenge-response authentication method to git://

["Shawn O. Pearce" <spearce@spearce.org>]

"Stephen R. van den Berg" <srb@cuci.nl> wrote:
> I'm not trying to solve all management problems, I'm just trying to
> offer a simple solution for the small-user-base-central-repository case
> without a lot of code-bloat on the git side.
> If it doesn't fit ones needs, use ssh or something else; but it does
> have its merits for the simple centralised setups.

OK, then my final two cents, and I'll shutup.

- Add to git-daemon a new service command, "git-authenticate-user".
- Clients request "git-authenticate-user 'repository'".
- The auth_user routine:
	enters 'repository' ('ala upload-pack)
	execs "git-authenticate-user ."

- git-authenticate-user:
	send pkt-line challenge
	recv pkt-line username
	recv pkt-line SHA-1(username + password + challenge)
	
	read gitconfig for "auth.passwordfile"
	read passwordfile for entry $username
		("user:pass:upload-pack,receive-pack")
	verify response

	send pkt-line ok/fail
	recv pkt-line "git-$service '.'"
	check $service is allowed
	exec git-$service .

-- 
Shawn.