Ben Collins-Sussman <sussman@collab.net> writes:
> Greg Stein <gstein@lyra.org> writes:
>
> > * server A is CollabNet's server, holding SourceCast source
> > - access via https using your corporate password
> > * server B is svn.collab.net, holding Subversion source
> > - access via http using your svn.c.n password
> > * your working copy uses svn:externals to aggregate these two
> >
> > Now, you go to do a commit and enter your user/pass for CollabNet's servers.
> > It is nicely protected via https, all is good. Then svn goes to commit
> > against svn.collab.net and it sends your corporate password over the public
> > Internet in the clear via http:.
> >
> > See the problem? :-)
>
> Yeah, I see. Rats. Sigh, I'll revert. :-)
>
> So the original itch we were trying to solve was the fact that
> TortoiseSVN, a long-lived GUI client, had this long-lived auth_baton
> that was being re-used on svn_client_foo() calls. Every single call
> to svn_client_foo() was causing a prompt for creds. Do we have any
> other solutions to this problem?
>
> The only thing I can think of is to do what Philip suggested about
> svn_client_add() -- make *all* the svn_client_foo() functions take a
> *list* of targets. That way everything can happen in a single RA
> session.
>
> Of course, what if the user runs 'svn ls URL1 URL2 URL3', and URL2
> happens to be a different server? Ugh.
I'll admit I kind of switched off during the long discussions about
the auth system :) If this has been discussed already just point me
at the archives
I'm looking at the interface in svn_auth.h and I don't understand why
svn_auth_first_credentials and svn_auth_next_credentials don't take an
some sort of context/realm parameter, something that will identify the
URL for which credentials are required. Does the current system ask
for credentials without any reference to the URL? Is this information
supposed to be transferred through the run-time hash?
It's not just a problem in the security case above, or for
TortoiseSVN, it seems to be more fundamental. Consider external
modules. At present I get prompted for a password on initial
checkout, as a user I can reasonably guess that I need to supply one
to match the top level URL I supplied. What then happens if there are
multiple external modules from other repositories? I get further
prompts for passwords and I appear to have no way to determine the URL
for which I have to provide credentials.
--
Philip Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Mon Feb 24 15:10:05 2003