bug (?) with client certificates & FakeBasicAuth?

Hi everybody,

I'm currently "experimenting" with client certificates and FakeBasicAuth
and have stumbled across a "strange behavior".

When Subversion has my username (NOT password) cached and after that, I
use a client certificate for a commit, it uses my old stored username as
"author" - which is "wrong anyway". Without ever asking for the password
- which is even worse.
I know this may not be a common situation (change in server
configuration), but still I wonder how it can use a user name without
asking for the password - and if there are further "security" implications.

Reproducible like this: (and for clarification)
(all of it using SVN 1.1.4)

1) svn commit ...
Password for client certificate: [xxx]
Password for user 'Holger': [xxx]

2) [now I enable FakeBasicAuth]

3) svn commit ...
Password for client certificate: [xxx]

No prompt for "Holger's password" - so far so good. Now I'd expect the
author for the commit to be something like "/C=DE/ST=Bavaria...."
But it IS "Holger"

4) I remove the "auth cache"

5) svn commit ...
Password for client certificate: [xxx]

Now this time the "author" is "/C=DE/ST=Bavaria...."

Looks like a bug to me. Possibly not serious, but "ugly"...

Comments?

P.S.: Please reply to me cc: or I might not see the mail...

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Wed Apr 13 16:50:02 2005