Deal with branches requiring basic http authentication

[Wouter van Heyst]

While trying to see how current bzr.dev deals with branches requiring http authentication I ran into the following error:

  bzr: ERROR: Invalid http response for http://host/protected/.bzr/branch-format: Unable to handle http code 401: expected 200 or 404 for full response.

The apache virtualhost in question has a simple
<Location /protected>
  AuthType Basic
  AuthName some branch
  AuthUserFile path/to/htpasswd
  Require valid-user
</Location>

The error is raised when you don't provide both username and password upfront.

 bzr branch http://host/protected

or
 bzr branch http://user@host/protected

However, bzr branch http://user:pass@host/protected does work correctly.

Either the error message needs to be improved, or bzr should learn to deal with a 401 and ask for credentials. Preferably the latter.

[Vincent Ladeuil (vila)]

Yes, the bug is that we do not even *try* to catch the 401 errors in the *pycurl* implementation.
The newly merged urllib implementation does however prompt for password in such cases.

[Wouter van Heyst (larstiq)]

bzr branch http+urllib://host/protected
becomes

bzr: ERROR: Invalid http response for http://host/protected/.bzr/branch-format: Unable to handle http code 401: Authorization Required

Are you sure it should work?

[Vincent Ladeuil (vila)]

Doh !

The current implementation is incomplete (we wait for the 401 error instead of sending auth information to avoid the round-trip, and only the basic auth scheme is implemented, and etc).

*But*, this implementation is *naive* in that it never asks for a *user* if a 401 is received, it only ask for the password if a user is already provided.

So, for 0.13, I'd say, let just require that the user is specified and wait for a the next implementation to enhance the proposed features.

Sooo, to finally answer the question, it "work", but may not meet user expectations. The next implementation should be more complete and address the case when no user is specified in the url and the server requires an authorization.

[Wouter van Heyst (larstiq)]

On Sun, Nov 26, 2006 at 06:23:37PM -0000, vila wrote:
> Doh !
>
> The current implementation is incomplete (we wait for the 401 error
> instead of sending auth information to avoid the round-trip, and only
> the basic auth scheme is implemented, and etc).
>
> *But*, this implementation is *naive* in that it never asks for a *user*
> if a 401 is received, it only ask for the password if a user is already
> provided.

That matches my experience.

> So, for 0.13, I'd say, let just require that the user is specified and
> wait for a the next implementation to enhance the proposed features.

Agreed.

> Sooo, to finally answer the question, it "work", but may not meet user
> expectations. The next implementation should be more complete and
> address the case when no user is specified in the url and the server
> requires an authorization.

Will you have time to do this for 0.14?

Wouter van Heyst

[Vincent Ladeuil (vila)]

For 0.14, I hope to do at least the 'on 401 errors, ask a username if none is provided in the url' part.

[Adam Mercer (skymoo)]

Whats the current status of this bug? As with using 0.14 I can't get a branch that is stored in a password protection portion of a webserver. I have tried to branch the repository, specifying the username and password, with

$ bzr branch http://user:password@host/repo

yet results with the error:

bzr: ERROR: Invalid http response for http://host/repo/.bzr/branch-format: Unable to handle http code 401: Authorization Required

I also get the same error when specifying the repo with http+urllib://user:pass@host/repo as mentioned earlier in this bug. It is very important for me to be able to branch from a repository stored on a password protected server, is there a timescae to when this will be supported?

[Martin Pool (mbp)]

On 4/2/07, Adam Mercer <email address hidden> wrote:
> Whats the current status of this bug? As with using 0.14 I can't get a
> branch that is stored in a password protection portion of a webserver.
> I have tried to branch the repository, specifying the username and
> password, with

I believe Vincent Ladeuil had some code towards this?

> $ bzr branch http://user:password@host/repo
>
> yet results with the error:
>
> bzr: ERROR: Invalid http response for http://host/repo/.bzr/branch-
> format: Unable to handle http code 401: Authorization Required
>
> I also get the same error when specifying the repo with
> http+urllib://user:pass@host/repo as mentioned earlier in this bug. It
> is very important for me to be able to branch from a repository stored
> on a password protected server, is there a timescae to when this will be
> supported?
>
> --
> Deal with branches requiring basic http authentication
> https://launchpad.net/bugs/72792
>
>

--
Martin

[Vincent Ladeuil (vila)]

>>>>> "adam" == Adam Mercer <email address hidden> writes:

    adam> Whats the current status of this bug? As with using 0.14 I can't get a
    adam> branch that is stored in a password protection portion of a webserver.
    adam> I have tried to branch the repository, specifying the username and
    adam> password, with

    adam> $ bzr branch http://user:password@host/repo

    adam> yet results with the error:

    adam> bzr: ERROR: Invalid http response for http://host/repo/.bzr/branch-
    adam> format: Unable to handle http code 401: Authorization Required

    adam> I also get the same error when specifying the repo with
    adam> http+urllib://user:pass@host/repo as mentioned earlier in this bug. It
    adam> is very important for me to be able to branch from a repository stored
    adam> on a password protected server, is there a timescae to when this will be
    adam> supported?

If you get the same error when adding it, it should be because you
don't have pycurl installed (so bzr use the urllib implementation by default).

From there you have two workarounds:

- install pycurl

- do not specify the password in the url and bzr should prompt
  you for one.

Otherwise, the attached patch, if applied, will take the url-supplied password into account.

A more complete solution (with tests) is under work.

[Vincent Ladeuil (vila)]

>>>>> "adam" == Adam Mercer <email address hidden> writes:

    adam> Whats the current status of this bug? As with using 0.14 I can't get a
    adam> branch that is stored in a password protection portion of a webserver.
    adam> I have tried to branch the repository, specifying the username and
    adam> password, with

    adam> $ bzr branch http://user:password@host/repo

    adam> yet results with the error:

    adam> bzr: ERROR: Invalid http response for http://host/repo/.bzr/branch-
    adam> format: Unable to handle http code 401: Authorization Required

    adam> I also get the same error when specifying the repo with
    adam> http+urllib://user:pass@host/repo as mentioned earlier in this bug. It
    adam> is very important for me to be able to branch from a repository stored
    adam> on a password protected server, is there a timescae to when this will be
    adam> supported?

If you get the same error when adding it, it should be because you
don't have pycurl installed (so bzr use the urllib implementation by default).

From there you have two workarounds:

- install pycurl

- do not specify the password in the url and bzr should prompt
  you for one.

Otherwise, the attached patch, if applied, will take the url-supplied password into account.

A more complete solution (with tests) is under work.

[Vincent Ladeuil (vila)]

>>>>> "adam" == Adam Mercer <email address hidden> writes:

    adam> Whats the current status of this bug? As with using 0.14 I can't get a
    adam> branch that is stored in a password protection portion of a webserver.
    adam> I have tried to branch the repository, specifying the username and
    adam> password, with

    adam> $ bzr branch http://user:password@host/repo

    adam> yet results with the error:

    adam> bzr: ERROR: Invalid http response for http://host/repo/.bzr/branch-
    adam> format: Unable to handle http code 401: Authorization Required

    adam> I also get the same error when specifying the repo with
    adam> http+urllib://user:pass@host/repo as mentioned earlier in this bug. It
    adam> is very important for me to be able to branch from a repository stored
    adam> on a password protected server, is there a timescae to when this will be
    adam> supported?

If you get the same error when adding it, it should be because you
don't have pycurl installed (so bzr use the urllib implementation by default).

From there you have two workarounds:

- install pycurl

- do not specify the password in the url and bzr should prompt
  you for one.

Otherwise, the attached patch, if applied, will take the url-supplied password into account.

A more complete solution (with tests) is under work.

[Vincent Ladeuil (vila)]

>>>>> "adam" == Adam Mercer <email address hidden> writes:

    adam> Whats the current status of this bug? As with using 0.14 I can't get a
    adam> branch that is stored in a password protection portion of a webserver.
    adam> I have tried to branch the repository, specifying the username and
    adam> password, with

    adam> $ bzr branch http://user:password@host/repo

    adam> yet results with the error:

    adam> bzr: ERROR: Invalid http response for http://host/repo/.bzr/branch-
    adam> format: Unable to handle http code 401: Authorization Required

    adam> I also get the same error when specifying the repo with
    adam> http+urllib://user:pass@host/repo as mentioned earlier in this bug. It
    adam> is very important for me to be able to branch from a repository stored
    adam> on a password protected server, is there a timescae to when this will be
    adam> supported?

If you get the same error when adding it, it should be because you
don't have pycurl installed (so bzr use the urllib implementation by default).

From there you have two workarounds:

- install pycurl

- do not specify the password in the url and bzr should prompt
  you for one.

Otherwise, the attached patch, if applied, will take the url-supplied password into account.

A more complete solution (with tests) is under work.

[Vincent Ladeuil (vila)]

>>>>> "adam" == Adam Mercer <email address hidden> writes:

    adam> Whats the current status of this bug? As with using 0.14 I can't get a
    adam> branch that is stored in a password protection portion of a webserver.
    adam> I have tried to branch the repository, specifying the username and
    adam> password, with

    adam> $ bzr branch http://user:password@host/repo

    adam> yet results with the error:

    adam> bzr: ERROR: Invalid http response for http://host/repo/.bzr/branch-
    adam> format: Unable to handle http code 401: Authorization Required

    adam> I also get the same error when specifying the repo with
    adam> http+urllib://user:pass@host/repo as mentioned earlier in this bug. It
    adam> is very important for me to be able to branch from a repository stored
    adam> on a password protected server, is there a timescae to when this will be
    adam> supported?

If you get the same error when adding it, it should be because you
don't have pycurl installed (so bzr use the urllib implementation by default).

From there you have two workarounds:

- install pycurl

- do not specify the password in the url and bzr should prompt
  you for one.

Otherwise, the attached patch, if applied, will take the url-supplied password into account.

A more complete solution (with tests) is under work.

[Vincent Ladeuil (vila)]

>>>>> "adam" == Adam Mercer <email address hidden> writes:

    adam> Whats the current status of this bug? As with using 0.14 I can't get a
    adam> branch that is stored in a password protection portion of a webserver.
    adam> I have tried to branch the repository, specifying the username and
    adam> password, with

    adam> $ bzr branch http://user:password@host/repo

    adam> yet results with the error:

    adam> bzr: ERROR: Invalid http response for http://host/repo/.bzr/branch-
    adam> format: Unable to handle http code 401: Authorization Required

    adam> I also get the same error when specifying the repo with
    adam> http+urllib://user:pass@host/repo as mentioned earlier in this bug. It
    adam> is very important for me to be able to branch from a repository stored
    adam> on a password protected server, is there a timescae to when this will be
    adam> supported?

If you get the same error when adding it, it should be because you
don't have pycurl installed (so bzr use the urllib implementation by default).

From there you have two workarounds:

- install pycurl

- do not specify the password in the url and bzr should prompt
  you for one.

Otherwise, the attached patch, if applied, will take the url-supplied password into account.

A more complete solution (with tests) is under work.

[Vincent Ladeuil (vila)]

Sorry for the spam, return key get stucked :-(

[Vincent Ladeuil (vila)]

A more complete patch have been proposed which covers the webdav needs (even if it doesn't fix the issue reported here)

[Vincent Ladeuil (vila)]

The actual situation (bzr 0.16) is that bzr requires the user to appear in the url when credentials are needed to connect to a remote server with http. sftp and ftp use a default user obtained from getpass.getuser().

This does not seem adequate for http though.

No protocol prompt for a user name if it is needed. But they all prompt for a password when appropriate (except for http+pycurl which do not provide the necessary hooks)

I considered this bug fixed. Feel free to open a new one if you consider that bzr should prompt for user too.

[Bubba Siggler (bud3)]

Hi all,
this is what i get Connection error: Couldn't resolve host 'baraar' ( -2
'Name or service nor known'. it requested "HTTP flint-dude@rar password:

best regards

flint

On 6/8/07, vila <email address hidden> wrote:
>
> The actual situation (bzr 0.16) is that bzr requires the user to appear
> in the url when credentials are needed to connect to a remote server
> with http. sftp and ftp use a default user obtained from
> getpass.getuser().
>
> This does not seem adequate for http though.
>
> No protocol prompt for a user name if it is needed. But they all prompt
> for a password when appropriate (except for http+pycurl which do not
> provide the necessary hooks)
>
> I considered this bug fixed. Feel free to open a new one if you consider
> that bzr should prompt for user too.
>
> ** Changed in: bzr (upstream)
> Status: In Progress => Fix Released
> Target: None => 0.16
>
> ** Changed in: bzr.webdav (upstream)
> Status: Fix Committed => Fix Released
>
> --
> Deal with branches requiring basic http authentication
> https://bugs.launchpad.net/bugs/72792
> You received this bug notification because you are a member of Bazaar
> Developers, which is the registrant for Bazaar.
>

--
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFFkcN7yXWcajQQndYRAgbqAKCMyXN9Jx4g0X7jocg+aUSFz0x4LwCgrURW
eGtqLjpzQVYa9+gzpCRtB84=
=zrpM
-----END PGP SIGNATURE-----

[Manatsawin Hanmongkolchai (whs)]

$ bzr push http+webdav://<email address hidden>/private/bug
HTTP <email address hidden>, Realm: 'WHS-Bugtracker private section code upload' password:
HTTP <email address hidden>, Realm: 'WHS-Bugtracker private section code upload' password:
bzr: ERROR: Invalid http response for http://bug.whsgroup.ath.cx/private/bug: Unable to handle http code 401: Authorization Required

In the repository, the bug directory was created but there are no file in.

[Michael B. Trausch (mtrausch)]

The status on this is "Fix Released", but this problem still seems to happen. Using a company-internal SVN server and bzr 1.6.1 with bzr-svn 0.4.11:

Monday, 2008-Oct-06 at 11:03:29 - mbt@zest - Linux v2.6.27
Ubuntu Intrepid:[0-89/1265-0]:Projects> bzr branch https://<urlToRepo>
bzr: ERROR: Invalid http response for https://<urlToRepo>/.bzr/branch-format: Unable to handle http code 401: Authorization Required

Monday, 2008-Oct-06 at 11:04:27 - mbt@zest - Linux v2.6.27
Ubuntu Intrepid:[0-90/1266-3]:Projects> bzr branch svn+https://<urlToRepo>
The svn+ syntax is deprecated, use https://<urlToRepo> instead.
<https://status.staffasap.com:443> SVN Access mbt password:
<https://status.staffasap.com:443> SVN Access mbt password:
Branched 232 revision(s).

Per bug 124908, this would seem to be a bzr issue.

[dmuir (dmuir)]

I'm still having this issue
bzr 1.8
webdav 1.6.0
python 2.5
pycurl 7.16.4

bzr branch http+webdav://<urlToRepo>
gives me:
bzr: ERROR: Invalid http response for http://<urlToRepo>: Unable to handle http code 401: Authorization Required

bzr branch http+webdav://<user>:<pass>@<urlToRepo>
gives me:
bzr: ERROR: http://<urlToRepo> is permanently redirected to http://<urlToRepo/

I've even tried supplying the authentication details in authentication.conf, but as far as I can tell, this file is being ignored.

[Vincent Ladeuil (vila)]

Please don't add comments to closed bugs, you're making it far harder to track the issue.

File a new bug instead, try running:

  'bzr branch -Dhttp http+webdav://<user>:<pass>@<urlToRepo>'

and add your .bzr.log (bzr version will tell you where it is) to your new bug report.

Also note that the webdav plugin contains a NOTES file with some hints regarding the DAV server configuration, please add the relevant part of your DAV server too.

[dmuir (dmuir)]

apologies, will open a new bug report. I just reported it here since I thought it would be easier to reopen the bug since the new one would basically be a duplicate of this one.

[dmuir (dmuir)]

new bug here:
https://bugs.launchpad.net/bzr.webdav/+bug/294560