103
104
* ``scheme``: can be empty (meaning the rest of the definition can be used
105
for any scheme), ``SFTP`` and ``bzr+ssh`` should not be used here, ``ssh``
106
should be used instead since this is the real scheme regarding
106
109
* ``host``: can be empty (to act as a default for any host),
108
111
* ``port`` can be empty (useful when an host provides several servers for the
109
same scheme), only numerical values are allowed,
112
same scheme), only numerical values are allowed, this should be used only
113
when the server uses a port different than the scheme standard port,
111
115
* ``path``: can be empty (FTP or SFTP will never user it),
113
* ``user``: can be empty (and will use the same default as ``bzr``, python's
114
``getpass.get_user()``),
117
* ``user``: can be empty (``bzr`` will defaults to python's
118
``getpass.get_user()`` and attempt another matching(see below)),
116
120
* ``password``: can be empty (for security reasons, a user may use the
117
definitions without storing the passwords but want to be prompted).
121
definitions without storing the passwords but want to be prompted ; or the
122
password will be provided by an external plugin via the
123
``password_encoding`` mechanism decribed below).
119
125
* ``password_encoding``: can be empty (default is ``plaintext``).
132
138
3. ``scheme`` matches even if decorators are used in the requested URL,
134
4. ``host`` matches if included in the requested URL. ``foo.net`` will match a
135
requested ``bzr.foo.net``.
140
4. ``host`` matches exactly or act as a domain if it starts with '.'
141
(``project.bzr.sf.net`` will match ``.bzr.sf.net`` but ``projectbzr.sf.net``
142
will not match ``bzr.sf.net``).
137
144
5. ``port`` matches if included in the requested URL (exact matches only)
159
166
.. [#password_encoding] Additional password encoding methods may be defined
160
167
that will rely on external means to store the password which, in these
161
cases, will not appear anymore in the definition but be provided. An
162
encoding named ``netrc`` for example will provide passwords by using the
168
cases, will not appear anymore in the definition. It is assumed that
169
additional password encodings will provide a storage outside of the file
170
described here. An encoding named ``netrc`` for example will provide
171
passwords by retrieving them in the ``.netrc`` file.
181
189
``~/.bazaar/authentication.conf`` will use the same file format than
182
190
``~/.bazaar/bazaar.conf``.
184
Each section will define an authentication definition.
192
Each section describes an authentication definition.
186
194
The section name is an arbitrary string, only the ``DEFAULT`` value is reserved
187
195
and should appear as the *last* section.
213
221
This section could define:
215
* ``user``: default user to be used.
223
* ``user``: default user to be used (if not defined the usual
224
bzr way applies, see below).
217
226
* ``password_encoding``: default password encoding.
236
245
bzr branch ftp://foo.net/bzr/branch
237
246
bzr pull ftp://bzr.foo.net/bzr/product/branch/trunk
239
* all connections are done with the same ``user`` (the local one) and the
240
password is always prompted with some exceptions::
248
* all connections are done with the same ``user`` (the remote one for which
249
the default bzr one is not appropriate) and the password is always prompted
250
with some exceptions::
242
252
# Pet projects on hobby.net
246
verify_certificates=no
248
256
password=obvious1234
254
263
password='c2VjcmV0LXBhc3M='
255
264
password_encoding=base64
265
verify_certificates=no # Still searching a free certificate provider
268
# Our local user is barbaz, on all remote sites we're known as foobar
260
* an HTTP server that also acts as a proxy (weird)::
271
* an HTTP server and a proxy::
262
273
# development branches on dev server
292
host=proxy.company.com
283
295
password=proxypass1
285
Note that the proxy should be specified last because it uses no path. An
286
alternative is to specify the port used by the proxy.
297
* source hosting provider declaring sub-domains for each project::
300
# we use sftp, but ssh is the scheme used for authentication
302
# The leading '.' ensures that 'sf.net' alone doesn't match
305
325
Get a user from ``~/.bazaar/authentication.conf`` or prompt for one if none is
306
326
found. Continue as 2.
308
Note: A user will be queried only if the server requires it for ``HTTP``, other
309
protocols always require a user.
328
Note: A user will be queried only if the server requires it for ``HTTP`` or
329
``HTTPS``, other protocols always require a user.
311
331
In any case, if the server refuses the authentication, bzr reports to the user
315
335
--------------------------
317
337
* bzr should be able to prompt for a ``user`` for a given (``scheme``, ``host``
318
[, ``realm``]). Note that ``realm`` may be available only after a first
338
[, ``realm``]). Note that ``realm`` is available only after a first
319
339
connection attempt to the server.
321
341
* No assumptions should be made about the clients of this service
added
removed
doc/developers/authentication-ring.txt
