104
103
* ``scheme``: can be empty (meaning the rest of the definition can be used
105
for any scheme), ``SFTP`` and ``bzr+ssh`` should not be used here, ``ssh``
106
should be used instead since this is the real scheme regarding
109
106
* ``host``: can be empty (to act as a default for any host),
111
108
* ``port`` can be empty (useful when an host provides several servers for the
112
same scheme), only numerical values are allowed, this should be used only
113
when the server uses a port different than the scheme standard port,
109
same scheme), only numerical values are allowed,
115
111
* ``path``: can be empty (FTP or SFTP will never user it),
117
* ``user``: can be empty (``bzr`` will defaults to python's
118
``getpass.get_user()`` and attempt another matching(see below)),
113
* ``user``: can be empty (and will use the same default as ``bzr``, python's
114
``getpass.get_user()``),
120
116
* ``password``: can be empty (for security reasons, a user may use the
121
definitions without storing the passwords but want to be prompted ; or the
122
password will be provided by an external plugin via the
123
``password_encoding`` mechanism decribed below).
117
definitions without storing the passwords but want to be prompted).
125
119
* ``password_encoding``: can be empty (default is ``plaintext``).
138
132
3. ``scheme`` matches even if decorators are used in the requested URL,
140
4. ``host`` matches exactly or act as a domain if it starts with '.'
141
(``project.bzr.sf.net`` will match ``.bzr.sf.net`` but ``projectbzr.sf.net``
142
will not match ``bzr.sf.net``).
134
4. ``host`` matches if included in the requested URL. ``foo.net`` will match a
135
requested ``bzr.foo.net``.
144
137
5. ``port`` matches if included in the requested URL (exact matches only)
166
159
.. [#password_encoding] Additional password encoding methods may be defined
167
160
that will rely on external means to store the password which, in these
168
cases, will not appear anymore in the definition. It is assumed that
169
additional password encodings will provide a storage outside of the file
170
described here. An encoding named ``netrc`` for example will provide
171
passwords by retrieving them in the ``.netrc`` file.
161
cases, will not appear anymore in the definition but be provided. An
162
encoding named ``netrc`` for example will provide passwords by using the
189
181
``~/.bazaar/authentication.conf`` will use the same file format than
190
182
``~/.bazaar/bazaar.conf``.
192
Each section describes an authentication definition.
184
Each section will define an authentication definition.
194
186
The section name is an arbitrary string, only the ``DEFAULT`` value is reserved
195
187
and should appear as the *last* section.
221
213
This section could define:
223
* ``user``: default user to be used (if not defined the usual
224
bzr way applies, see below).
215
* ``user``: default user to be used.
226
217
* ``password_encoding``: default password encoding.
245
236
bzr branch ftp://foo.net/bzr/branch
246
237
bzr pull ftp://bzr.foo.net/bzr/product/branch/trunk
248
* all connections are done with the same ``user`` (the remote one for which
249
the default bzr one is not appropriate) and the password is always prompted
250
with some exceptions::
239
* all connections are done with the same ``user`` (the local one) and the
240
password is always prompted with some exceptions::
252
242
# Pet projects on hobby.net
246
verify_certificates=no
256
248
password=obvious1234
263
254
password='c2VjcmV0LXBhc3M='
264
255
password_encoding=base64
265
verify_certificates=no # Still searching a free certificate provider
268
# Our local user is barbaz, on all remote sites we're known as foobar
271
* an HTTP server and a proxy::
260
* an HTTP server that also acts as a proxy (weird)::
273
262
# development branches on dev server
292
host=proxy.company.com
295
283
password=proxypass1
297
* source hosting provider declaring sub-domains for each project::
300
# we use sftp, but ssh is the scheme used for authentication
302
# The leading '.' ensures that 'sf.net' alone doesn't match
285
Note that the proxy should be specified last because it uses no path. An
286
alternative is to specify the port used by the proxy.
325
305
Get a user from ``~/.bazaar/authentication.conf`` or prompt for one if none is
326
306
found. Continue as 2.
328
Note: A user will be queried only if the server requires it for ``HTTP`` or
329
``HTTPS``, other protocols always require a user.
308
Note: A user will be queried only if the server requires it for ``HTTP``, other
309
protocols always require a user.
331
311
In any case, if the server refuses the authentication, bzr reports to the user
335
315
--------------------------
337
317
* bzr should be able to prompt for a ``user`` for a given (``scheme``, ``host``
338
[, ``realm``]). Note that ``realm`` is available only after a first
318
[, ``realm``]). Note that ``realm`` may be available only after a first
339
319
connection attempt to the server.
341
321
* No assumptions should be made about the clients of this service
added
removed
doc/developers/authentication-ring.txt
