Description of problem: A HTTP proxy supports Kerberos, NTLM and Basic authentication. Curl works with --proxy-basic or --proxy-ntlm options, but not with --proxy-any, since Version-Release number of selected component (if applicable): How reproducible: Always. Steps to Reproduce: 1. curl --proxy=.. --proxy-user=.. --proxy-any http://... 2. 3. Actual results: Proxy replies with "407 Proxy Authentication Required". Curl retries the same request without using any of the supported authentication mechanisms. Expected results: Some auth header used in 2nd request (Basic or NTLM, if kerberos broken) Additional info: The following message appears in verbose logs: * gss_init_sec_context() failed: : Credentials cache file '/tmp/krb5cc_1000' not found Bug 769254 is the original Yum BZ with attached logs.
related upstream thread: http://curl.haxx.se/mail/archive-2011-04/0021.html
If Kerberos together with some other authentication method(s) are both enabled and available, curl decides to use Kerberos, which is the most preferred method, without checking that we have valid credentials first. Later, when gss_init_sec_context() fails, it is already too late to change the authentication method because the data->state.authproxy.avail flags are already cleared.
After all, I do not think that curl should be trying NTLM if gss_init_sec_context() fails. The documentation of --anyauth says "Tells curl to figure out authentication method by itself, and use the most secure one the remote site claims to support." Implementing what you ask for would make curl less secure. It will be better to clarify the documentation of --proxy-anyauth in the same way as --anyauth.
Maybe I do not quite understand. But it seems to me an indication forced methods of authentication in the future will complicate the integration yum with proxy configuration in gnome. They having only proxy address and port.
(In reply to comment #4) > They having only proxy address and port. How can you set the username and passwd then?
Created attachment 595854 [details] GNOME proxy settings
Programs such as Firefox, Chrome and Opera can request proxy password by yourself if it needed.
related upstream thread: http://thread.gmane.org/gmane.comp.web.curl.library/36363
It possible to make curl to read the settings are seted through network proxy [1]? [1] https://bugzilla.redhat.com/attachment.cgi?id=595854
I want to work such a construction out of the box: $ sudo rpm --import http://yum.mariadb.org/RPM-GPG-KEY-MariaDB curl: (7) couldn't connect to host error: http://yum.mariadb.org/RPM-GPG-KEY-MariaDB: import read failed(2).
(In reply to comment #9) > It possible to make curl to read the settings are seted through network > proxy [1]? Make sure the following environment variables are set properly: http://curl.haxx.se/docs/manpage.html#ENVIRONMENT
Created attachment 601440 [details] GNOME proxy settings (Method->Automatic)
I am sure when I use Method->Manual which displayed on screenshot [1] all environment variables are set properly in both case: ALL_PROXY=socks://10.10.9.62:8080/ FTP_PROXY=http://10.10.9.62:8080/ HTTPS_PROXY=http://10.10.9.62:8080/ HTTP_PROXY=http://10.10.9.62:8080/ NO_PROXY=localhost,127.0.0.0/8 all_proxy=socks://10.10.9.62:8080/ ftp_proxy=http://10.10.9.62:8080/ http_proxy=http://10.10.9.62:8080/ https_proxy=http://10.10.9.62:8080/ no_proxy=localhost,127.0.0.0/8 But in my case we have MS ISA proxy with NTLM auth :( Curl must detect this and ask me for login and password. Also I wonder how work Method-> Automatic [2]? Because when I set Method-> Automatic all browsers continue work, but environment variables ALL_PROXY, FTP_PROXY, HTTPS_PROXY, HTTP_PROXY, NO_PROXY, all_proxy, ftp_proxy, http_proxy, https_proxy, no_proxy are not exists. [1] https://bugzilla.redhat.com/attachment.cgi?id=595854 [2] https://bugzilla.redhat.com/attachment.cgi?id=601440
(In reply to comment #13) > Also I wonder how work Method-> Automatic [2]? http://curl.haxx.se/docs/faq.html#Does_curl_support_Javascript_or
Fixed upstream https://sourceforge.net/p/curl/bugs/1127/