Description of problem:

From upstream commit https://github.com/git/git/commit/4dbe66464b4fd695c5989cc272fa0edd6475037c:

"Apache servers using mod_auth_kerb can be configured to allow the user to authenticate either using Negotiate (using the Kerberos ticket) or Basic authentication (using the Kerberos password). Often, one will want to use Negotiate authentication if it is available, but fall back to Basic authentication if the ticket is missing or expired.

However, libcurl will try very hard to use something other than Basic auth, even over HTTPS. If Basic and something else are offered, libcurl will never attempt to use Basic, even if the other option fails. Teach the HTTP client code to stop trying authentication mechanisms that don't use a password (currently Negotiate) after the first failure, since if they failed the first time, they will never succeed."

This is biting us, because we are dealing with an application (Atlassian Bitbucket) for which most clients can use Negotiate authentication (via GSSAPI/Kerberos), but a few clients need to fall back to Basic auth. Even though we have set KrbMethodK5Passwd on in the httpd configuration, because httpd offers both Negotiate and Basic auth, without commit 4dbe6646, git fails to fall back to Basic authentication due to the underlying behavior of libcurl.

Commit 4dbe6646 landed in git 2.3.1, so no officially support version of git in RHEL7 has this fix. (The base git is 1.8; the version of git in the RHSC is 1.9.)

Please backport commit 4dbe6646 to RHEL7, by taking one of the following actions (in order of preference):

1. Backport commit 4dbe6646 to the base git package (git-1.8).
2. Rebase the RHSC version of git to at least git 2.3.1.
3. Backport commit 4dbe6646 to the current RHSC version of git (git19).

Version-Release number of selected component (if applicable):

git-1.8.3.1-12.el7_4
git19-1.2-4.el7