gvfs-helper: fix support for NTLM

[jeffhostetler]

Fix NTLM support in gvfs-helper.

NTLM is handled magically by libcurl when we CURLAUTH_ANY is enabled AND
we passed empty username/password. This lets it negotiate with the server and
choose the best authentication scheme.

Signed-off-by: Jeff Hostetler jeffhost@microsoft.com

[derrickstolee]

We'll want to verify that this doesn't make the cache server OR cloud situation break. I wonder if there is anything we can do to tell if we are against the on-prem server or not.

An installer is sent to the customer, which should help.

[jeffhostetler]

Yeah, however, the cache server never sends back 401s,
only a generic 400 Bad Request (with a human-readable
"creds required" message in the html body (sigh)). So the
cache server will never trigger the 401 logic inside libcurl.
So I think this change is net-neutral WRT the cache servers.

But now that you say that, I am tempted to move the cache
server case into its own branch (and kill the TODO comment).

A larger take-away here is that cache servers (that require
auth) won't work with origin servers that use NTLM.

I'll fix this up and submit another version shortly.

[mjcheetham]

Source context (because GitHub doesn't let you comment on lines outside the default context): this change is in the else part of the if (creds && creds->username) control flow statement.

What happens if creds->username is NULL and creds->password != NULL?
We'll fall into this CURLAUTH_ANY flow.. what if users have manually specified a PAT as the password without a username? I.e., ":password123"

[jeffhostetler]

Good question. I was modeling this on how they set this up in [1].
But, you're right, PATs work with an empty username [2].

I should update this to allow either to be set and route us into
Basic auth. (The assumption is that if GCM chooses NTLM,
it'll send back empty strings for both. (I also wonder how all
of this works with Kerberos/GSSNegotiate, but that's for another
day.))

[1] https://github.com/microsoft/git/blob/vfs-2.26.1/http.c#L485

[2] https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page

[jeffhostetler]

Version 2 moves most of the server-specific code into helper functions and
tries to explain everything that I could think of. Actual code path should be
pretty identical (effectively).

[jeffhostetler]

I'm tempted to leave this as 2 commits. 1 to show the actual functional fix to make NTLM work. And the second to better explain why. But I'm open to suggestion.

[derrickstolee]

Customer reports this does solve their issue. Thanks!

[jeffhostetler]

Great! Thanks!