AuthHub repo

[Nathaniel McCallum]

I have rebased Sumit's AuthHub yubikey plugin onto a new repo here:
https://github.com/npmccallum/krb5-anonsvn/tree/AuthHub

This will allow proper merging with the upstream github repo.  Let me
know if I've missed anything.

Nathaniel

[Linus Nordberg]

Nathaniel McCallum <npmccallum(a)redhat.com&gt; wrote
Mon, 23 May 2011 14:59:43 -0400:

| I have rebased Sumit's AuthHub yubikey plugin onto a new repo here:
| https://github.com/npmccallum/krb5-anonsvn/tree/AuthHub

Great.


| This will allow proper merging with the upstream github repo.  Let me
| know if I've missed anything.

I just made the ykclient method in our "otp" plugin (heavily based on
Sumits yubikey_otp plugin) use the client_id (a.k.a. API key) found in
the kdb rather than in configuration (krb5.conf) and verified it against
the YubiServe authentication server.

This work can be found in the otp-wip branch of
git://git.nordu.net/krb-otp.  We have the somewhat dubious PA-FX-COOKIE
fixes in generic code sitting in that branch too, which I'd like to
discuss with MIT people before merging to a more proper branch.


I think I should push to a fork of npmccallum/krb5-anonsvn to github as
well, to be able to follow your work.  What would be a good way for
rebasing on top of your AuthHub branch?  My naïve tries with doing "git
pull --rebase" resulted in tons of conflicts in code I've never touched,
likely conflicts that you've already solved when you did your rebase.
My git skills are clearly imperfect.  Hints much appreciated.

[Nathaniel McCallum]

On Fri, 2011-05-27 at 14:57 +0200, Linus Nordberg wrote:
>  Nathaniel McCallum <npmccallum(a)redhat.com&gt; wrote
>  Mon, 23 May 2011 14:59:43 -0400:
>  
>  | I have rebased Sumit's AuthHub yubikey plugin onto a new repo here:
>  | https://github.com/npmccallum/krb5-anonsvn/tree/AuthHub
>  
>  Great.
>  
>  
>  | This will allow proper merging with the upstream github repo.  Let me
>  | know if I've missed anything.
>  
>  I just made the ykclient method in our "otp" plugin (heavily based on
>  Sumits yubikey_otp plugin) use the client_id (a.k.a. API key) found in
>  the kdb rather than in configuration (krb5.conf) and verified it against
>  the YubiServe authentication server.
>  
>  This work can be found in the otp-wip branch of
>  git://git.nordu.net/krb-otp.  We have the somewhat dubious PA-FX-COOKIE
>  fixes in generic code sitting in that branch too, which I'd like to
>  discuss with MIT people before merging to a more proper branch. 
>  I think I should push to a fork of npmccallum/krb5-anonsvn to github
> as
>  well, to be able to follow your work.  What would be a good way for
>  rebasing on top of your AuthHub branch?  My naïve tries with doing "git
>  pull --rebase" resulted in tons of conflicts in code I've never touched,
>  likely conflicts that you've already solved when you did your rebase.
>  My git skills are clearly imperfect.  Hints much appreciated. 
Well, truth be told, I'm new here and trying to come up to speed on krb5
as quickly as possible. :)

As far as git is concerned, this problem arises due to the evolutionary
nature of git-svn which means that different versions of git-svn create
different "versions" of history which then cannot be merged/rebased on.
There are essentially two ways to fix your problem, neither of them
optimal.

The first approach is to just manually merge your unique commits by
exporting patches and merging them (manually) onto a fresh clone of the
upstream repo.

The second approach is to use git replace to establish a common root.
First, "git remote add" a reference to the proper upstream. Then, find
the sha of the last commit you have in common with upstream.  Then, find
that same commit in upstream and get its sha.  Last you do: "git replace
$mysha $upstreamsha".  This is essentially a destructive rebase: you are
forcing git to acknowledge the upstream history.  Once you do this, you
should be able to rebase on upstream pretty easily.

In short, if you want to use git (you should, upstream krb5 is moving to
git) avoid the svn repo and just use the github branch.

Nathaniel

[Linus Nordberg]

Nathaniel McCallum <npmccallum(a)redhat.com&gt; wrote
Fri, 27 May 2011 09:49:10 -0400:

| As far as git is concerned, this problem arises due to the evolutionary
| nature of git-svn which means that different versions of git-svn create
| different "versions" of history which then cannot be merged/rebased on.

That explains things.  Thanks!


| The second approach is to use git replace to establish a common root.

Seems like that worked out for me.  I forked your repo on github and
added that as a new remote ("github").  Then I replaced and pulled like
so:

  git replace f5f17196 53b83e4f
  git pull --rebase github AuthHub

Pushed this to branch otp-wip of ln5/krb5-anonsvn at github.

Thanks for the help and let me know if there's anything unclear about my
patches.  Both available methods have been smoke tested

  method     OTP generator   OTP validator
  --------------------------------------------------
  basicauth  oathtool[0]     mod_authn_otp + Apache
  ykclient   YubiKey[1]      YubiServe[2]

[0] from oath-toolkit
[1] physical key in YubiKey mode
[2] yubico-yubiserve-3.1