[PATCH 1/4] git-cvsserver: implement script based pserver authentication

 Documentation/git-cvsserver.txt |   46 +++++++++++++++++++++++++++++++++++---
 git-cvsserver.perl              |   28 +++++++++++++++++++++++
 t/t9400-git-cvsserver-server.sh |   45 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 115 insertions(+), 4 deletions(-)

diff --git a/Documentation/git-cvsserver.txt b/Documentation/git-cvsserver.txt
index 7004dd2..b3c3122 100644
--- a/Documentation/git-cvsserver.txt
+++ b/Documentation/git-cvsserver.txt

@@ -100,10 +100,48 @@ looks like

 ------

 Only anonymous access is provided by pserve by default. To commit you
-will have to create pserver accounts, simply add a gitcvs.authdb
-setting in the config file of the repositories you want the cvsserver
-to allow writes to, for example:
+will have to specify an authentication option in the config file.
+Currently there are two options are available for authentication through
+pserver in git-cvsserver: one through an authenticator script and an other
+through a textual authentication database. If both are specified in the config
+file then the script based solution will be used.
+
+  a. To use the authentication script based method, simply add a
+     gitcvs.authscript setting in the config file of the repositories you want
+     the cvsserver to allow writes to, for example:
++
+--
+------
+
+   [gitcvs]
+    authscript = /usr/local/bin/cvsserver-auth.sh
+
+------
+The file specified here must be executable by the user the git-cvsserver runs
+under the name of. This script has to read exactly two lines from its standard
+input as long as git-cvsserver passes the username and the password on separate
+lines. After the script did its task by checking the username and password
+given it has to return zero if the authentication was successful and return
+other value if it was not.
+
+Here is an example for an authentication script which checks the users against
+active directory:
+------
+#!/bin/sh
+# /usr/local/bin/cvsserver-auth.sh

+read username
+read password
+
+wbinfo -a "${username}%${password}"
+------
+--
+
+  b. To use the authentication database based method, simply add a
+     gitcvs.authdb setting in the config file of the repositories you want the
+     cvsserver to allow writes to, for example:
++
+--
 ------

   [gitcvs]

@@ -125,7 +163,7 @@ Alternatively you can produce the password with

perl's crypt() operator:
 -----
   perl -e 'my ($user, $pass) = @ARGV; printf "%s:%s\n", $user,
crypt($user, $pass)' $USER password
 -----
-
+--
 Then provide your password via the pserver method, for example:
 ------
   cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

diff --git a/git-cvsserver.perl b/git-cvsserver.perl
index e9f3037..9664e86 100755
--- a/git-cvsserver.perl
+++ b/git-cvsserver.perl

@@ -197,6 +197,34 @@ if ($state->{method} eq 'pserver') {

        }

        # Fall through to LOVE
+    } elsif (exists $cfg->{gitcvs}->{authscript}) {
+        my $authscript = $cfg->{gitcvs}->{authscript};
+
+        unless (-x $authscript) {
+            print "E The authentication script specified in ";
+            print "[gitcvs.authscript] cannot be executed\n";
+            print "I HATE YOU\n";
+            exit 1;
+        }
+
+        open my $script_fd, '|-', "'$authscript'"
+            or die "Couldn't open authentication script '$authscript': $!";
+
+        if (length($password) > 0) {
+            $password = descramble($password);
+        }
+
+        print $script_fd "$user\n";
+        print $script_fd "$password\n";
+        close $script_fd;
+
+        unless ($? == 0) {
+            print "E External script authentication failed.\n";
+            print "I HATE YOU\n";
+            exit 1;
+        }
+
+        # Fall through to LOVE
    } else {
        # Trying to authenticate a user
        if (not exists $cfg->{gitcvs}->{authdb}) {

diff --git a/t/t9400-git-cvsserver-server.sh b/t/t9400-git-cvsserver-server.sh
index 8639506..0743e9a 100755
--- a/t/t9400-git-cvsserver-server.sh
+++ b/t/t9400-git-cvsserver-server.sh

@@ -64,6 +64,16 @@ test_expect_success 'basic checkout' \

 # PSERVER AUTHENTICATION
 #------------------------

+cat >"$SERVERDIR/authscript.sh" <<EOF
+#!/bin/sh
+read username
+read password
+
+test "x\$username" = xcvsuser -a "x\$password" = xcvspassword
+EOF
+
+chmod a+x "$SERVERDIR/authscript.sh"
+
 cat >request-anonymous  <<EOF
 BEGIN AUTH REQUEST
 $SERVERDIR

@@ -134,6 +144,41 @@ test_expect_success 'pserver authentication

failure (login/non-anonymous user)'
   fi &&
   sed -ne \$p log | grep "^I HATE YOU\$"'

+GIT_DIR="$SERVERDIR" git config --unset gitcvs.authdb || exit 1
+GIT_DIR="$SERVERDIR" git config gitcvs.authscript
"$SERVERDIR/authscript.sh" || exit 1
+
+test_expect_success 'pserver authentication (authscript)' \
+  'cat request-anonymous | git-cvsserver pserver >log 2>&1 &&
+   sed -ne \$p log | grep "^I LOVE YOU\$"'
+
+test_expect_success 'pserver authentication failure (authscript,
non-anonymous user)' \
+  'if cat request-git | git-cvsserver pserver >log 2>&1
+   then
+       false
+   else
+       true
+   fi &&
+   sed -ne \$p log | grep "^I HATE YOU\$"'
+
+test_expect_success 'pserver authentication success (authscript,
non-anonymous user with password)' \
+  'cat login-git-ok | git-cvsserver pserver >log 2>&1 &&
+   sed -ne \$p log | grep "^I LOVE YOU\$"'
+
+test_expect_success 'pserver authentication (authscript, login)' \
+  'cat login-anonymous | git-cvsserver pserver >log 2>&1 &&
+   sed -ne \$p log | grep "^I LOVE YOU\$"'
+
+test_expect_success 'pserver authentication failure (authscript,
login/non-anonymous user)' \
+  'if cat login-git | git-cvsserver pserver >log 2>&1
+   then
+       false
+   else
+       true
+   fi &&
+   sed -ne \$p log | grep "^I HATE YOU\$"'
+
+GIT_DIR="$SERVERDIR" git config --unset gitcvs.authscript || exit 1
+GIT_DIR="$SERVERDIR" git config gitcvs.authdb "$SERVERDIR/auth.db" || exit 1

 # misuse pserver authentication for testing of req_Root

--
1.7.2.rc1.dirty