libgit2/libgit2 — pull request #1960 by ethomson (2013-11-14 19:34:57+00:00)
Title: NTLM/Negotiate support in WinHTTP

Adding support for "single signon" or "default credentials" in the WinHTTP stack via NTLM and Negotiate.

I thought that this was just magically handled automatically when you use WinHTTP, In fact we tested this when we were adding WinHTTP support and deemed it to work. However whether WinHTTP provides credentials over NTLM is a little bit of magic. It has three security levels: low, medium and high. "Low" means that NTLM credentials will always be sent to the remote host, "medium" means that NTLM credentials will only be sent to hosts on the "intranet", and "high" means that NTLM credentials will never be sent.

"Intranet" is defined as: any host that is excluded in your proxy exclusion list if you have a proxy server defined. So NTLM was only for people who had proxy servers configured and only to hosts that were bypassing the proxy.

This is totally useless.

Instead I added `git_cred_default` which reflects "default credentials". On Windows, this will be used by WinHTTP for NTLM and Negotiate types. I will (but am not now) add GSSAPI hooks for Negotiate authentication on non-Windows, optionally compiled in for users that have GSSAPI + Kerberos.

The first commit in this series also plumbs error codes from credential callbacks as `GIT_EUSER`. This is not meant to be complete, hence https://github.com/libgit2/libgit2/issues/1959.

There is a unit test for this behavior: it fails the credential callback, but only runs if credentials are set in the environment variables. If this seems a little odd and / or brittle, I'll pull it out.