Re: have any one tried SSPI with Subversion 1.5 ?

Question is not about safe or unsafe; I just want to know why
functionality which was there previously is removed.

On 8/29/08, Alec Kloss <alec.kloss_at_oracle.com> wrote:
> On 2008-08-29 15:46, vishwajeet singh wrote:
>> http://tortoisesvn.net/docs/release/TortoiseSVN_en/tsvn-serversetup.html#tsvn-serversetup-apache-5
>>
>> This document says that you can have sspi authentication with SSL
>> connections only.
>>
>> Can any one confirm this??
>>
>> I am presently using 1.4.6 and using sspi authentication which is working
>> fine both for ssl and non ssl connections.
>>
>
> You're probably really asking about Negotiate/SPNEGO with Neon
> linked against Microsoft's SSPI library. As I recall, it's
> considered unsafe to use Negotiate/SPNEGO without SSL as it's
> lacking either mutual authentication or man-in-the-middle
> protection. Neon therefore won't do Negotiate unless you are also
> doing SSL. I just confirmed this with Tortoise 1.5.2 and a
> pre-built command line svn 1.5.1 client.
>
> --
> Alec.Kloss_at_oracle.com Oracle Middleware
> PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x432B9956
>

-- 
Cheers,
Vishwajeet
http://www.singhvishwajeet.com
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe_at_subversion.tigris.org
For additional commands, e-mail: users-help_at_subversion.tigris.org