Bazaar should attempt Basic authentication if HTTP server offers NTLM

[Daniel Cassidy]

Our internal SVN server runs Apache and uses mod_auth_sspi to support NTLM authentication. It also supports Basic authentication as a fallback (I understand this combination is somewhat common).

Unfortunately I cannot branch an SVN repository from this server using Bazaar because Bazaar chokes on receiving an HTTP 401 with WWW-Authenticate: NTLM. Bazaar gets as far as attempting to POST to .bzr/smart and GET from .bzr/branch-format before giving up:

bzr: ERROR: Invalid http response for http://svn.example.org/svn/example/trunk/example/.bzr/branch-format: Unable to handle http code 401: Authorization Required

I suggest attempting Basic authentication as a fallback if NTLM is offered. I’m reporting this as a Bazaar bug rather than a bzr-svn bug because the problem seems to be with Bazaar itself.

This is related to bug #244879 except that bug is requesting NTLM support, whereas I am suggesting using Basic as a fallback in the meantime (or if NTLM fails).

[Robert Collins (lifeless)]

On Fri, 2009-04-24 at 14:02 +0000, Daniel Cassidy wrote:
>
>
> I suggest attempting Basic authentication as a fallback if NTLM is
> offered. I’m reporting this as a Bazaar bug rather than a bzr-svn bug
> because the problem seems to be with Bazaar itself.

Its up to web servers to list what authentication methods they support -
if your server lists basic as a supported means, and bzr is bugfree in
this regard :P, then we would use it.

However, I suspect the issue here is unrelated to NTLM vs Basic -
however, Vincent knows our http stack's issue rather better than I, so
I'll let him comment further.

-Rob

[Daniel Cassidy (djcsdy)]

2009/4/26 Robert Collins <email address hidden>:
> Its up to web servers to list what authentication methods they support -
> if your server lists basic as a supported means, and bzr is bugfree in
> this regard :P, then we would use it.

It is offering Basic but Bazaar isn't attempting to use it. Perhaps
you're right and this isn't NTLM related. I jumped to that conclusion
because old versions of a certain SVN implementation get confused by
the offer of NTLM and have to be forced to use Basic instead.

[Vincent Ladeuil (vila)]

It looks like the server is presenting both NTLM and Basic as possible auth schemes, so either our NTLM handling is bogus or our overall auth scheme is, I'll look into that.

Also, you just compromised your login/password, you didn't obfuscate the logs well enough so you may want to change your password (it looks like a good and strong one (too many caps for my taste though), but I know it now...).

[Vincent Ladeuil (vila)]

@Daniel: I deleted the logs but that may not be enough to protect your password.

[Daniel Cassidy (djcsdy)]

Oops, well spotted. Well, no problem, I’ve changed it.

[Vincent Ladeuil (vila)]

Fixed in the associate branch, feedback welcome.

[Daniel Cassidy (djcsdy)]

I know it's late but I just wanted to confirm that this is fixed in bzr 1.15 and working perfectly for me.

This is much appreciated -- thanks for fixing :).

[Vincent Ladeuil (vila)]

For the record, the problem was that bzr was trying only the first proposed authentication scheme (NTLM here which isn't supported) without falling back to the other proposed schemes (Basic here which *is* supported).