From: Junio C Hamano <gitster@pobox.com>
To: Rick van Rein <rick@openfortress.nl>
Cc: git@vger.kernel.org, Jeff King <peff@peff.net>,
Matthew John Cheetham <mjcheetham@github.com>
Subject: Re: Git over HTTP; have flexible SASL authentication
Date: Mon, 06 Feb 2023 14:08:07 -0800 [thread overview]
Message-ID: <xmqqk00u4fco.fsf@gitster.g> (raw)
In-Reply-To: <20230204113408.GD21507@openfortress.nl> (Rick van Rein's message of "Sat, 4 Feb 2023 11:34:08 +0000")
Rick van Rein <rick@openfortress.nl> writes:
> SASL assumes that the endpoints can hold state and progress through any
> challenge/response exchange, in multiple steps if needed. This is not
> trivial with stateless HTTP, but we fixed it with a "s2s" argument which
> can hold the (datestamped, signed, encrypted) state on the server side.
That's nice to know, and its applications below do look useful, at
least to me.
> A few mechanisms that spring to mind as useful with Git over HTTP-SASL are
>
> - Kerberos / GSS-API, desirable for companies using its single sign-on
> _ FIDO, currently being added to SASL to benefit all protocols
> - OPAQUE, a very modern crypto, developed in IETF now
> - SXOVER-PLUS, our own work that calls back to a user's domain for login
> (so no server-stored credentials needed, only access control)
>
> I'm curious if this would indeed be considered an improvement to Git.
>
> Cheers,
> -Rick
prev parent reply other threads:[~2023-02-06 22:08 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-27 16:34 Git over HTTP; have flexible SASL authentication Rick van Rein
2023-01-27 17:06 ` Junio C Hamano
2023-02-01 11:24 ` Jeff King
2023-02-01 19:36 ` Matthew John Cheetham
2023-02-04 11:34 ` Rick van Rein
2023-02-06 22:08 ` Junio C Hamano [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=xmqqk00u4fco.fsf@gitster.g \
--to=gitster@pobox.com \
--cc=git@vger.kernel.org \
--cc=mjcheetham@github.com \
--cc=peff@peff.net \
--cc=rick@openfortress.nl \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.