Data Structures | |
struct | svn_auth_provider_t |
The main authentication "provider" vtable. More... | |
struct | svn_auth_provider_object_t |
A provider object, ready to be put into an array and given to svn_auth_open(). More... | |
struct | svn_auth_cred_simple_t |
SVN_AUTH_CRED_SIMPLE credentials. More... | |
struct | svn_auth_cred_username_t |
SVN_AUTH_CRED_USERNAME credentials. More... | |
struct | svn_auth_cred_ssl_client_cert_t |
SVN_AUTH_CRED_SSL_CLIENT_CERT credentials. More... | |
struct | svn_auth_cred_ssl_client_cert_pw_t |
SVN_AUTH_CRED_SSL_CLIENT_CERT_PW credentials. More... | |
struct | svn_auth_ssl_server_cert_info_t |
SSL server certificate information used by SVN_AUTH_CRED_SSL_SERVER_TRUST providers. More... | |
struct | svn_auth_cred_ssl_server_trust_t |
SVN_AUTH_CRED_SSL_SERVER_TRUST credentials. More... | |
Defines | |
#define | SVN_AUTH_CRED_SIMPLE "svn.simple" |
Simple username/password pair credential kind. | |
#define | SVN_AUTH_CRED_USERNAME "svn.username" |
Username credential kind. | |
#define | SVN_AUTH_CRED_SSL_CLIENT_CERT "svn.ssl.client-cert" |
SSL client certificate credential type. | |
#define | SVN_AUTH_CRED_SSL_CLIENT_CERT_PW "svn.ssl.client-passphrase" |
SSL client certificate passphrase credential type. | |
#define | SVN_AUTH_CRED_SSL_SERVER_TRUST "svn.ssl.server" |
SSL server verification credential type. | |
Typedefs | |
typedef svn_auth_baton_t | svn_auth_baton_t |
The type of a Subversion authentication object. | |
typedef svn_auth_iterstate_t | svn_auth_iterstate_t |
The type of a Subversion authentication-iteration object. | |
typedef svn_auth_provider_t | svn_auth_provider_t |
The main authentication "provider" vtable. | |
typedef svn_auth_provider_object_t | svn_auth_provider_object_t |
A provider object, ready to be put into an array and given to svn_auth_open(). | |
typedef svn_auth_cred_simple_t | svn_auth_cred_simple_t |
SVN_AUTH_CRED_SIMPLE credentials. | |
typedef svn_auth_cred_username_t | svn_auth_cred_username_t |
SVN_AUTH_CRED_USERNAME credentials. | |
typedef svn_auth_cred_ssl_client_cert_t | svn_auth_cred_ssl_client_cert_t |
SVN_AUTH_CRED_SSL_CLIENT_CERT credentials. | |
typedef svn_auth_cred_ssl_client_cert_pw_t | svn_auth_cred_ssl_client_cert_pw_t |
SVN_AUTH_CRED_SSL_CLIENT_CERT_PW credentials. | |
typedef svn_auth_ssl_server_cert_info_t | svn_auth_ssl_server_cert_info_t |
SSL server certificate information used by SVN_AUTH_CRED_SSL_SERVER_TRUST providers. | |
typedef svn_auth_cred_ssl_server_trust_t | svn_auth_cred_ssl_server_trust_t |
SVN_AUTH_CRED_SSL_SERVER_TRUST credentials. | |
typedef svn_error_t *(* | svn_auth_simple_prompt_func_t )(svn_auth_cred_simple_t **cred, void *baton, const char *realm, const char *username, svn_boolean_t may_save, apr_pool_t *pool) |
Set *cred by prompting the user, allocating *cred in pool. | |
typedef svn_error_t *(* | svn_auth_username_prompt_func_t )(svn_auth_cred_username_t **cred, void *baton, const char *realm, svn_boolean_t may_save, apr_pool_t *pool) |
Set *cred by prompting the user, allocating *cred in pool. | |
Functions | |
svn_auth_ssl_server_cert_info_t * | svn_auth_ssl_server_cert_info_dup (const svn_auth_ssl_server_cert_info_t *info, apr_pool_t *pool) |
Return a deep copy of info, allocated in pool. |
We define an authentication "provider" as a module that is able to return a specific set of credentials. (e.g. username/password, certificate, etc.) Each provider implements a vtable that
For any given type of credentials, there can exist any number of separate providers -- each provider has a different method of fetching. (i.e. from a disk store, by prompting the user, etc.)
The application begins by creating an auth baton object, and "registers" some number of providers with the auth baton, in a specific order. (For example, it may first register a username/password provider that looks in disk store, then register a username/password provider that prompts the user.)
Later on, when any svn library is challenged, it asks the auth baton for the specific credentials. If the initial credentials fail to authenticate, the caller keeps requesting new credentials. Under the hood, libsvn_auth effectively "walks" over each provider (in order of registry), one at a time, until all the providers have exhausted all their retry options.
This system allows an application to flexibly define authentication behaviors (by changing registration order), and very easily write new authentication providers.
An auth_baton also contains an internal hashtable of run-time parameters; any provider or library layer can set these run-time parameters at any time, so that the provider has access to the data. (For example, certain run-time data may not be available until an authentication challenge is made.) Each credential type must document the run-time parameters that are made available to its providers.
|
Simple username/password pair credential kind. The following auth parameters may be available to the providers:
Definition at line 168 of file svn_auth.h. |
|
SSL client certificate credential type. The following auth parameters are available to the providers:
The following optional auth parameters are relevant to the providers:
Definition at line 218 of file svn_auth.h. |
|
SSL client certificate passphrase credential type.
The following optional auth parameters are relevant to the providers:
Definition at line 247 of file svn_auth.h. |
|
SSL server verification credential type. The following auth parameters are available to the providers:
The following optional auth parameters are relevant to the providers:
Definition at line 276 of file svn_auth.h. |
|
Username credential kind. The following optional auth parameters are relevant to the providers:
Definition at line 192 of file svn_auth.h. |
|
Set *cred by prompting the user, allocating *cred in pool. baton is an implementation-specific closure. If realm is non-null, maybe use it in the prompt string. If username is non-null, then the user might be prompted only for a password, but *creds would still be filled with both username and password. For example, a typical usage would be to pass username on the first call, but then leave it null for subsequent calls, on the theory that if credentials failed, it's as likely to be due to incorrect username as incorrect password. If may_save is FALSE, the auth system does not allow the credentials to be saved (to disk). A prompt function shall not ask the user if the credentials shall be saved if may_save is FALSE. For example, a GUI client with a remember password checkbox would grey out the checkbox if may_save is FALSE. Definition at line 352 of file svn_auth.h. |
|
Set *cred by prompting the user, allocating *cred in pool. baton is an implementation-specific closure. If realm is non-null, maybe use it in the prompt string. If may_save is FALSE, the auth system does not allow the credentials to be saved (to disk). A prompt function shall not ask the user if the credentials shall be saved if may_save is FALSE. For example, a GUI client with a remember username checkbox would grey out the checkbox if may_save is FALSE. Definition at line 372 of file svn_auth.h. |
|
Return a deep copy of info, allocated in pool.
|