00001 /** 00002 * @copyright 00003 * ==================================================================== 00004 * Licensed to the Apache Software Foundation (ASF) under one 00005 * or more contributor license agreements. See the NOTICE file 00006 * distributed with this work for additional information 00007 * regarding copyright ownership. The ASF licenses this file 00008 * to you under the Apache License, Version 2.0 (the 00009 * "License"); you may not use this file except in compliance 00010 * with the License. You may obtain a copy of the License at 00011 * 00012 * http://www.apache.org/licenses/LICENSE-2.0 00013 * 00014 * Unless required by applicable law or agreed to in writing, 00015 * software distributed under the License is distributed on an 00016 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 00017 * KIND, either express or implied. See the License for the 00018 * specific language governing permissions and limitations 00019 * under the License. 00020 * ==================================================================== 00021 * @endcopyright 00022 * 00023 * @file svn_auth.h 00024 * @brief Subversion's authentication system 00025 */ 00026 00027 #ifndef SVN_AUTH_H 00028 #define SVN_AUTH_H 00029 00030 #include <apr.h> 00031 #include <apr_pools.h> 00032 #include <apr_hash.h> 00033 #include <apr_tables.h> 00034 00035 #include "svn_types.h" 00036 #include "svn_config.h" 00037 00038 #ifdef __cplusplus 00039 extern "C" { 00040 #endif /* __cplusplus */ 00041 00042 /** Overview of the svn authentication system. 00043 * 00044 * We define an authentication "provider" as a module that is able to 00045 * return a specific set of credentials. (e.g. username/password, 00046 * certificate, etc.) Each provider implements a vtable that 00047 * 00048 * - can fetch initial credentials 00049 * - can retry the fetch (or try to fetch something different) 00050 * - can store the credentials for future use 00051 * 00052 * For any given type of credentials, there can exist any number of 00053 * separate providers -- each provider has a different method of 00054 * fetching. (i.e. from a disk store, by prompting the user, etc.) 00055 * 00056 * The application begins by creating an auth baton object, and 00057 * "registers" some number of providers with the auth baton, in a 00058 * specific order. (For example, it may first register a 00059 * username/password provider that looks in disk store, then register 00060 * a username/password provider that prompts the user.) 00061 * 00062 * Later on, when any svn library is challenged, it asks the auth 00063 * baton for the specific credentials. If the initial credentials 00064 * fail to authenticate, the caller keeps requesting new credentials. 00065 * Under the hood, libsvn_auth effectively "walks" over each provider 00066 * (in order of registry), one at a time, until all the providers have 00067 * exhausted all their retry options. 00068 * 00069 * This system allows an application to flexibly define authentication 00070 * behaviors (by changing registration order), and very easily write 00071 * new authentication providers. 00072 * 00073 * An auth_baton also contains an internal hashtable of run-time 00074 * parameters; any provider or library layer can set these run-time 00075 * parameters at any time, so that the provider has access to the 00076 * data. (For example, certain run-time data may not be available 00077 * until an authentication challenge is made.) Each credential type 00078 * must document the run-time parameters that are made available to 00079 * its providers. 00080 * 00081 * @defgroup auth_fns Authentication functions 00082 * @{ 00083 */ 00084 00085 00086 /** The type of a Subversion authentication object */ 00087 typedef struct svn_auth_baton_t svn_auth_baton_t; 00088 00089 /** The type of a Subversion authentication-iteration object */ 00090 typedef struct svn_auth_iterstate_t svn_auth_iterstate_t; 00091 00092 00093 /** The main authentication "provider" vtable. */ 00094 typedef struct svn_auth_provider_t 00095 { 00096 /** The kind of credentials this provider knows how to retrieve. */ 00097 const char *cred_kind; 00098 00099 /** Get an initial set of credentials. 00100 * 00101 * Set @a *credentials to a set of valid credentials within @a 00102 * realmstring, or NULL if no credentials are available. Set @a 00103 * *iter_baton to context that allows a subsequent call to @c 00104 * next_credentials, in case the first credentials fail to 00105 * authenticate. @a provider_baton is general context for the 00106 * vtable, @a parameters contains any run-time data that the 00107 * provider may need, and @a realmstring comes from the 00108 * svn_auth_first_credentials() call. 00109 */ 00110 svn_error_t * (*first_credentials)(void **credentials, 00111 void **iter_baton, 00112 void *provider_baton, 00113 apr_hash_t *parameters, 00114 const char *realmstring, 00115 apr_pool_t *pool); 00116 00117 /** Get a different set of credentials. 00118 * 00119 * Set @a *credentials to another set of valid credentials (using @a 00120 * iter_baton as the context from previous call to first_credentials 00121 * or next_credentials). If no more credentials are available, set 00122 * @a *credentials to NULL. If the provider only has one set of 00123 * credentials, this function pointer should simply be NULL. @a 00124 * provider_baton is general context for the vtable, @a parameters 00125 * contains any run-time data that the provider may need, and @a 00126 * realmstring comes from the svn_auth_first_credentials() call. 00127 */ 00128 svn_error_t * (*next_credentials)(void **credentials, 00129 void *iter_baton, 00130 void *provider_baton, 00131 apr_hash_t *parameters, 00132 const char *realmstring, 00133 apr_pool_t *pool); 00134 00135 /** Save credentials. 00136 * 00137 * Store @a credentials for future use. @a provider_baton is 00138 * general context for the vtable, and @a parameters contains any 00139 * run-time data the provider may need. Set @a *saved to TRUE if 00140 * the save happened, or FALSE if not. The provider is not required 00141 * to save; if it refuses or is unable to save for non-fatal 00142 * reasons, return FALSE. If the provider never saves data, then 00143 * this function pointer should simply be NULL. @a realmstring comes 00144 * from the svn_auth_first_credentials() call. 00145 */ 00146 svn_error_t * (*save_credentials)(svn_boolean_t *saved, 00147 void *credentials, 00148 void *provider_baton, 00149 apr_hash_t *parameters, 00150 const char *realmstring, 00151 apr_pool_t *pool); 00152 00153 } svn_auth_provider_t; 00154 00155 00156 /** A provider object, ready to be put into an array and given to 00157 svn_auth_open(). */ 00158 typedef struct svn_auth_provider_object_t 00159 { 00160 const svn_auth_provider_t *vtable; 00161 void *provider_baton; 00162 00163 } svn_auth_provider_object_t; 00164 00165 /** The type of function returning authentication provider. */ 00166 typedef void (*svn_auth_simple_provider_func_t)( 00167 svn_auth_provider_object_t **provider, 00168 apr_pool_t *pool); 00169 00170 00171 /** Specific types of credentials **/ 00172 00173 /** Simple username/password pair credential kind. 00174 * 00175 * The following auth parameters are available to the providers: 00176 * 00177 * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_CONFIG (@c svn_config_t*) 00178 * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS (@c svn_config_t*) 00179 * 00180 * The following auth parameters may be available to the providers: 00181 * 00182 * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*) 00183 * - @c SVN_AUTH_PARAM_DEFAULT_USERNAME (@c char*) 00184 * - @c SVN_AUTH_PARAM_DEFAULT_PASSWORD (@c char*) 00185 */ 00186 #define SVN_AUTH_CRED_SIMPLE "svn.simple" 00187 00188 /** @c SVN_AUTH_CRED_SIMPLE credentials. */ 00189 typedef struct svn_auth_cred_simple_t 00190 { 00191 /** Username */ 00192 const char *username; 00193 /** Password */ 00194 const char *password; 00195 /** Indicates if the credentials may be saved (to disk). For example, a 00196 * GUI prompt implementation with a remember password checkbox shall set 00197 * @a may_save to TRUE if the checkbox is checked. 00198 */ 00199 svn_boolean_t may_save; 00200 } svn_auth_cred_simple_t; 00201 00202 00203 /** Username credential kind. 00204 * 00205 * The following optional auth parameters are relevant to the providers: 00206 * 00207 * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*) 00208 * - @c SVN_AUTH_PARAM_DEFAULT_USERNAME (@c char*) 00209 */ 00210 #define SVN_AUTH_CRED_USERNAME "svn.username" 00211 00212 /** @c SVN_AUTH_CRED_USERNAME credentials. */ 00213 typedef struct svn_auth_cred_username_t 00214 { 00215 /** Username */ 00216 const char *username; 00217 /** Indicates if the credentials may be saved (to disk). For example, a 00218 * GUI prompt implementation with a remember username checkbox shall set 00219 * @a may_save to TRUE if the checkbox is checked. 00220 */ 00221 svn_boolean_t may_save; 00222 } svn_auth_cred_username_t; 00223 00224 00225 /** SSL client certificate credential type. 00226 * 00227 * The following auth parameters are available to the providers: 00228 * 00229 * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS (@c svn_config_t*) 00230 * - @c SVN_AUTH_PARAM_SERVER_GROUP (@c char*) 00231 * 00232 * The following optional auth parameters are relevant to the providers: 00233 * 00234 * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*) 00235 */ 00236 #define SVN_AUTH_CRED_SSL_CLIENT_CERT "svn.ssl.client-cert" 00237 00238 /** @c SVN_AUTH_CRED_SSL_CLIENT_CERT credentials. */ 00239 typedef struct svn_auth_cred_ssl_client_cert_t 00240 { 00241 /** Absolute path to the certificate file */ 00242 const char *cert_file; 00243 /** Indicates if the credentials may be saved (to disk). For example, a 00244 * GUI prompt implementation with a remember certificate checkbox shall 00245 * set @a may_save to TRUE if the checkbox is checked. 00246 */ 00247 svn_boolean_t may_save; 00248 } svn_auth_cred_ssl_client_cert_t; 00249 00250 00251 /** A function returning an SSL client certificate passphrase provider. */ 00252 typedef void (*svn_auth_ssl_client_cert_pw_provider_func_t)( 00253 svn_auth_provider_object_t **provider, 00254 apr_pool_t *pool); 00255 00256 /** SSL client certificate passphrase credential type. 00257 * 00258 * @note The realmstring used with this credential type must be a name that 00259 * makes it possible for the user to identify the certificate. 00260 * 00261 * The following auth parameters are available to the providers: 00262 * 00263 * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_CONFIG (@c svn_config_t*) 00264 * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS (@c svn_config_t*) 00265 * - @c SVN_AUTH_PARAM_SERVER_GROUP (@c char*) 00266 * 00267 * The following optional auth parameters are relevant to the providers: 00268 * 00269 * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*) 00270 */ 00271 #define SVN_AUTH_CRED_SSL_CLIENT_CERT_PW "svn.ssl.client-passphrase" 00272 00273 /** @c SVN_AUTH_CRED_SSL_CLIENT_CERT_PW credentials. */ 00274 typedef struct svn_auth_cred_ssl_client_cert_pw_t 00275 { 00276 /** Certificate password */ 00277 const char *password; 00278 /** Indicates if the credentials may be saved (to disk). For example, a 00279 * GUI prompt implementation with a remember password checkbox shall set 00280 * @a may_save to TRUE if the checkbox is checked. 00281 */ 00282 svn_boolean_t may_save; 00283 } svn_auth_cred_ssl_client_cert_pw_t; 00284 00285 00286 /** SSL server verification credential type. 00287 * 00288 * The following auth parameters are available to the providers: 00289 * 00290 * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS (@c svn_config_t*) 00291 * - @c SVN_AUTH_PARAM_SERVER_GROUP (@c char*) 00292 * - @c SVN_AUTH_PARAM_SSL_SERVER_FAILURES (@c apr_uint32_t*) 00293 * - @c SVN_AUTH_PARAM_SSL_SERVER_CERT_INFO 00294 * (@c svn_auth_ssl_server_cert_info_t*) 00295 * 00296 * The following optional auth parameters are relevant to the providers: 00297 * 00298 * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*) 00299 */ 00300 #define SVN_AUTH_CRED_SSL_SERVER_TRUST "svn.ssl.server" 00301 00302 /** SSL server certificate information used by @c 00303 * SVN_AUTH_CRED_SSL_SERVER_TRUST providers. 00304 */ 00305 typedef struct svn_auth_ssl_server_cert_info_t 00306 { 00307 /** Primary CN */ 00308 const char *hostname; 00309 /** ASCII fingerprint */ 00310 const char *fingerprint; 00311 /** ASCII date from which the certificate is valid */ 00312 const char *valid_from; 00313 /** ASCII date until which the certificate is valid */ 00314 const char *valid_until; 00315 /** DN of the certificate issuer */ 00316 const char *issuer_dname; 00317 /** Base-64 encoded DER certificate representation */ 00318 const char *ascii_cert; 00319 } svn_auth_ssl_server_cert_info_t; 00320 00321 /** 00322 * Return a deep copy of @a info, allocated in @a pool. 00323 * 00324 * @since New in 1.3. 00325 */ 00326 svn_auth_ssl_server_cert_info_t * 00327 svn_auth_ssl_server_cert_info_dup(const svn_auth_ssl_server_cert_info_t *info, 00328 apr_pool_t *pool); 00329 00330 /** @c SVN_AUTH_CRED_SSL_SERVER_TRUST credentials. */ 00331 typedef struct svn_auth_cred_ssl_server_trust_t 00332 { 00333 /** Indicates if the credentials may be saved (to disk). For example, a 00334 * GUI prompt implementation with a checkbox to accept the certificate 00335 * permanently shall set @a may_save to TRUE if the checkbox is checked. 00336 */ 00337 svn_boolean_t may_save; 00338 /** Bit mask of the accepted failures */ 00339 apr_uint32_t accepted_failures; 00340 } svn_auth_cred_ssl_server_trust_t; 00341 00342 00343 00344 /** Credential-constructing prompt functions. **/ 00345 00346 /** These exist so that different client applications can use 00347 * different prompt mechanisms to supply the same credentials. For 00348 * example, if authentication requires a username and password, a 00349 * command-line client's prompting function might prompt first for the 00350 * username and then for the password, whereas a GUI client's would 00351 * present a single dialog box asking for both, and a telepathic 00352 * client's would read all the information directly from the user's 00353 * mind. All these prompting functions return the same type of 00354 * credential, but the information used to construct the credential is 00355 * gathered in an interface-specific way in each case. 00356 */ 00357 00358 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool. 00359 * @a baton is an implementation-specific closure. 00360 * 00361 * If @a realm is non-NULL, maybe use it in the prompt string. 00362 * 00363 * If @a username is non-NULL, then the user might be prompted only 00364 * for a password, but @a *cred would still be filled with both 00365 * username and password. For example, a typical usage would be to 00366 * pass @a username on the first call, but then leave it NULL for 00367 * subsequent calls, on the theory that if credentials failed, it's 00368 * as likely to be due to incorrect username as incorrect password. 00369 * 00370 * If @a may_save is FALSE, the auth system does not allow the credentials 00371 * to be saved (to disk). A prompt function shall not ask the user if the 00372 * credentials shall be saved if @a may_save is FALSE. For example, a GUI 00373 * client with a remember password checkbox would grey out the checkbox if 00374 * @a may_save is FALSE. 00375 */ 00376 typedef svn_error_t *(*svn_auth_simple_prompt_func_t)( 00377 svn_auth_cred_simple_t **cred, 00378 void *baton, 00379 const char *realm, 00380 const char *username, 00381 svn_boolean_t may_save, 00382 apr_pool_t *pool); 00383 00384 00385 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool. 00386 * @a baton is an implementation-specific closure. 00387 * 00388 * If @a realm is non-NULL, maybe use it in the prompt string. 00389 * 00390 * If @a may_save is FALSE, the auth system does not allow the credentials 00391 * to be saved (to disk). A prompt function shall not ask the user if the 00392 * credentials shall be saved if @a may_save is FALSE. For example, a GUI 00393 * client with a remember username checkbox would grey out the checkbox if 00394 * @a may_save is FALSE. 00395 */ 00396 typedef svn_error_t *(*svn_auth_username_prompt_func_t)( 00397 svn_auth_cred_username_t **cred, 00398 void *baton, 00399 const char *realm, 00400 svn_boolean_t may_save, 00401 apr_pool_t *pool); 00402 00403 00404 /** @name SSL server certificate failure bits 00405 * 00406 * @note These values are stored in the on disk auth cache by the SSL 00407 * server certificate auth provider, so the meaning of these bits must 00408 * not be changed. 00409 * @{ 00410 */ 00411 /** Certificate is not yet valid. */ 00412 #define SVN_AUTH_SSL_NOTYETVALID 0x00000001 00413 /** Certificate has expired. */ 00414 #define SVN_AUTH_SSL_EXPIRED 0x00000002 00415 /** Certificate's CN (hostname) does not match the remote hostname. */ 00416 #define SVN_AUTH_SSL_CNMISMATCH 0x00000004 00417 /** @brief Certificate authority is unknown (i.e. not trusted) */ 00418 #define SVN_AUTH_SSL_UNKNOWNCA 0x00000008 00419 /** @brief Other failure. This can happen if an unknown failure occurs 00420 * that we do not handle yet. */ 00421 #define SVN_AUTH_SSL_OTHER 0x40000000 00422 /** @} */ 00423 00424 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool. 00425 * @a baton is an implementation-specific closure. 00426 * 00427 * @a cert_info is a structure describing the server cert that was 00428 * presented to the client, and @a failures is a bitmask that 00429 * describes exactly why the cert could not be automatically validated, 00430 * composed from the constants SVN_AUTH_SSL_* (@c SVN_AUTH_SSL_NOTYETVALID 00431 * etc.). @a realm is a string that can be used in the prompt string. 00432 * 00433 * If @a may_save is FALSE, the auth system does not allow the credentials 00434 * to be saved (to disk). A prompt function shall not ask the user if the 00435 * credentials shall be saved if @a may_save is FALSE. For example, a GUI 00436 * client with a trust permanently checkbox would grey out the checkbox if 00437 * @a may_save is FALSE. 00438 */ 00439 typedef svn_error_t *(*svn_auth_ssl_server_trust_prompt_func_t)( 00440 svn_auth_cred_ssl_server_trust_t **cred, 00441 void *baton, 00442 const char *realm, 00443 apr_uint32_t failures, 00444 const svn_auth_ssl_server_cert_info_t *cert_info, 00445 svn_boolean_t may_save, 00446 apr_pool_t *pool); 00447 00448 00449 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool. 00450 * @a baton is an implementation-specific closure. @a realm is a string 00451 * that can be used in the prompt string. 00452 * 00453 * If @a may_save is FALSE, the auth system does not allow the credentials 00454 * to be saved (to disk). A prompt function shall not ask the user if the 00455 * credentials shall be saved if @a may_save is FALSE. For example, a GUI 00456 * client with a remember certificate checkbox would grey out the checkbox 00457 * if @a may_save is FALSE. 00458 */ 00459 typedef svn_error_t *(*svn_auth_ssl_client_cert_prompt_func_t)( 00460 svn_auth_cred_ssl_client_cert_t **cred, 00461 void *baton, 00462 const char *realm, 00463 svn_boolean_t may_save, 00464 apr_pool_t *pool); 00465 00466 00467 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool. 00468 * @a baton is an implementation-specific closure. @a realm is a string 00469 * identifying the certificate, and can be used in the prompt string. 00470 * 00471 * If @a may_save is FALSE, the auth system does not allow the credentials 00472 * to be saved (to disk). A prompt function shall not ask the user if the 00473 * credentials shall be saved if @a may_save is FALSE. For example, a GUI 00474 * client with a remember password checkbox would grey out the checkbox if 00475 * @a may_save is FALSE. 00476 */ 00477 typedef svn_error_t *(*svn_auth_ssl_client_cert_pw_prompt_func_t)( 00478 svn_auth_cred_ssl_client_cert_pw_t **cred, 00479 void *baton, 00480 const char *realm, 00481 svn_boolean_t may_save, 00482 apr_pool_t *pool); 00483 00484 /** A type of callback function for asking whether storing a password to 00485 * disk in plaintext is allowed. 00486 * 00487 * In this callback, the client should ask the user whether storing 00488 * a password for the realm identified by @a realmstring to disk 00489 * in plaintext is allowed. 00490 * 00491 * The answer is returned in @a *may_save_plaintext. 00492 * @a baton is an implementation-specific closure. 00493 * All allocations should be done in @a pool. 00494 * 00495 * @since New in 1.6 00496 */ 00497 typedef svn_error_t *(*svn_auth_plaintext_prompt_func_t)( 00498 svn_boolean_t *may_save_plaintext, 00499 const char *realmstring, 00500 void *baton, 00501 apr_pool_t *pool); 00502 00503 /** A type of callback function for asking whether storing a passphrase to 00504 * disk in plaintext is allowed. 00505 * 00506 * In this callback, the client should ask the user whether storing 00507 * a passphrase for the realm identified by @a realmstring to disk 00508 * in plaintext is allowed. 00509 * 00510 * The answer is returned in @a *may_save_plaintext. 00511 * @a baton is an implementation-specific closure. 00512 * All allocations should be done in @a pool. 00513 * 00514 * @since New in 1.6 00515 */ 00516 typedef svn_error_t *(*svn_auth_plaintext_passphrase_prompt_func_t)( 00517 svn_boolean_t *may_save_plaintext, 00518 const char *realmstring, 00519 void *baton, 00520 apr_pool_t *pool); 00521 00522 00523 /** Initialize an authentication system. 00524 * 00525 * Return an authentication object in @a *auth_baton (allocated in @a 00526 * pool) that represents a particular instance of the svn 00527 * authentication system. @a providers is an array of @c 00528 * svn_auth_provider_object_t pointers, already allocated in @a pool 00529 * and intentionally ordered. These pointers will be stored within @a 00530 * *auth_baton, grouped by credential type, and searched in this exact 00531 * order. 00532 */ 00533 void 00534 svn_auth_open(svn_auth_baton_t **auth_baton, 00535 const apr_array_header_t *providers, 00536 apr_pool_t *pool); 00537 00538 /** Set an authentication run-time parameter. 00539 * 00540 * Store @a name / @a value pair as a run-time parameter in @a 00541 * auth_baton, making the data accessible to all providers. @a name 00542 * and @a value will NOT be duplicated into the auth_baton's pool. 00543 * To delete a run-time parameter, pass NULL for @a value. 00544 */ 00545 void 00546 svn_auth_set_parameter(svn_auth_baton_t *auth_baton, 00547 const char *name, 00548 const void *value); 00549 00550 /** Get an authentication run-time parameter. 00551 * 00552 * Return a value for run-time parameter @a name from @a auth_baton. 00553 * Return NULL if the parameter doesn't exist. 00554 */ 00555 const void * 00556 svn_auth_get_parameter(svn_auth_baton_t *auth_baton, 00557 const char *name); 00558 00559 /** Universal run-time parameters, made available to all providers. 00560 00561 If you are writing a new provider, then to be a "good citizen", 00562 you should notice these global parameters! Note that these 00563 run-time params should be treated as read-only by providers; the 00564 application is responsible for placing them into the auth_baton 00565 hash. */ 00566 00567 /** The auth-hash prefix indicating that the parameter is global. */ 00568 #define SVN_AUTH_PARAM_PREFIX "svn:auth:" 00569 00570 /** 00571 * @name Default credentials defines 00572 * Property values are const char *. 00573 * @{ */ 00574 /** Default username provided by the application itself (e.g. --username) */ 00575 #define SVN_AUTH_PARAM_DEFAULT_USERNAME SVN_AUTH_PARAM_PREFIX "username" 00576 /** Default password provided by the application itself (e.g. --password) */ 00577 #define SVN_AUTH_PARAM_DEFAULT_PASSWORD SVN_AUTH_PARAM_PREFIX "password" 00578 /** @} */ 00579 00580 /** @brief The application doesn't want any providers to prompt 00581 * users. Property value is irrelevant; only property's existence 00582 * matters. */ 00583 #define SVN_AUTH_PARAM_NON_INTERACTIVE SVN_AUTH_PARAM_PREFIX "non-interactive" 00584 00585 /** @brief The application doesn't want any providers to save passwords 00586 * to disk. Property value is irrelevant; only property's existence 00587 * matters. */ 00588 #define SVN_AUTH_PARAM_DONT_STORE_PASSWORDS SVN_AUTH_PARAM_PREFIX \ 00589 "dont-store-passwords" 00590 00591 /** @brief Indicates whether providers may save passwords to disk in 00592 * plaintext. Property value can be either SVN_CONFIG_TRUE, 00593 * SVN_CONFIG_FALSE, or SVN_CONFIG_ASK. 00594 * @since New in 1.6. 00595 */ 00596 #define SVN_AUTH_PARAM_STORE_PLAINTEXT_PASSWORDS SVN_AUTH_PARAM_PREFIX \ 00597 "store-plaintext-passwords" 00598 00599 /** @brief The application doesn't want any providers to save passphrase 00600 * to disk. Property value is irrelevant; only property's existence 00601 * matters. 00602 * @since New in 1.6. 00603 */ 00604 #define SVN_AUTH_PARAM_DONT_STORE_SSL_CLIENT_CERT_PP \ 00605 SVN_AUTH_PARAM_PREFIX "dont-store-ssl-client-cert-pp" 00606 00607 /** @brief Indicates whether providers may save passphrase to disk in 00608 * plaintext. Property value can be either SVN_CONFIG_TRUE, 00609 * SVN_CONFIG_FALSE, or SVN_CONFIG_ASK. 00610 * @since New in 1.6. 00611 */ 00612 #define SVN_AUTH_PARAM_STORE_SSL_CLIENT_CERT_PP_PLAINTEXT \ 00613 SVN_AUTH_PARAM_PREFIX "store-ssl-client-cert-pp-plaintext" 00614 00615 /** @brief The application doesn't want any providers to save credentials 00616 * to disk. Property value is irrelevant; only property's existence 00617 * matters. */ 00618 #define SVN_AUTH_PARAM_NO_AUTH_CACHE SVN_AUTH_PARAM_PREFIX "no-auth-cache" 00619 00620 /** @brief The following property is for SSL server cert providers. This 00621 * provides a pointer to an @c apr_uint32_t containing the failures 00622 * detected by the certificate validator. */ 00623 #define SVN_AUTH_PARAM_SSL_SERVER_FAILURES SVN_AUTH_PARAM_PREFIX \ 00624 "ssl:failures" 00625 00626 /** @brief The following property is for SSL server cert providers. This 00627 * provides the cert info (svn_auth_ssl_server_cert_info_t). */ 00628 #define SVN_AUTH_PARAM_SSL_SERVER_CERT_INFO SVN_AUTH_PARAM_PREFIX \ 00629 "ssl:cert-info" 00630 00631 /** This provides a pointer to a @c svn_config_t containting the config 00632 * category. */ 00633 #define SVN_AUTH_PARAM_CONFIG_CATEGORY_CONFIG SVN_AUTH_PARAM_PREFIX \ 00634 "config-category-config" 00635 00636 /** This provides a pointer to a @c svn_config_t containting the servers 00637 * category. */ 00638 #define SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS SVN_AUTH_PARAM_PREFIX \ 00639 "config-category-servers" 00640 00641 /** @deprecated Provided for backward compatibility with the 1.5 API. */ 00642 #define SVN_AUTH_PARAM_CONFIG SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS 00643 00644 /** The current server group. */ 00645 #define SVN_AUTH_PARAM_SERVER_GROUP SVN_AUTH_PARAM_PREFIX "server-group" 00646 00647 /** @brief A configuration directory that overrides the default 00648 * ~/.subversion. */ 00649 #define SVN_AUTH_PARAM_CONFIG_DIR SVN_AUTH_PARAM_PREFIX "config-dir" 00650 00651 /** Get an initial set of credentials. 00652 * 00653 * Ask @a auth_baton to set @a *credentials to a set of credentials 00654 * defined by @a cred_kind and valid within @a realmstring, or NULL if 00655 * no credentials are available. Otherwise, return an iteration state 00656 * in @a *state, so that the caller can call 00657 * svn_auth_next_credentials(), in case the first set of credentials 00658 * fails to authenticate. 00659 * 00660 * Use @a pool to allocate @a *state, and for temporary allocation. 00661 * Note that @a *credentials will be allocated in @a auth_baton's pool. 00662 */ 00663 svn_error_t * 00664 svn_auth_first_credentials(void **credentials, 00665 svn_auth_iterstate_t **state, 00666 const char *cred_kind, 00667 const char *realmstring, 00668 svn_auth_baton_t *auth_baton, 00669 apr_pool_t *pool); 00670 00671 /** Get another set of credentials, assuming previous ones failed to 00672 * authenticate. 00673 * 00674 * Use @a state to fetch a different set of @a *credentials, as a 00675 * follow-up to svn_auth_first_credentials() or 00676 * svn_auth_next_credentials(). If no more credentials are available, 00677 * set @a *credentials to NULL. 00678 * 00679 * Note that @a *credentials will be allocated in @c auth_baton's pool. 00680 */ 00681 svn_error_t * 00682 svn_auth_next_credentials(void **credentials, 00683 svn_auth_iterstate_t *state, 00684 apr_pool_t *pool); 00685 00686 /** Save a set of credentials. 00687 * 00688 * Ask @a state to store the most recently returned credentials, 00689 * presumably because they successfully authenticated. 00690 * All allocations should be done in @a pool. 00691 * 00692 * If no credentials were ever returned, do nothing. 00693 */ 00694 svn_error_t * 00695 svn_auth_save_credentials(svn_auth_iterstate_t *state, 00696 apr_pool_t *pool); 00697 00698 /** Forget a set (or all) memory-cached credentials. 00699 * 00700 * Remove references (if any) in @a auth_baton to credentials cached 00701 * therein. If @a cred_kind and @a realmstring are non-NULL, forget 00702 * only the credentials associated with those credential types and 00703 * realm. Otherwise @a cred_kind and @a realmstring must both be 00704 * NULL, and this function will forget all credentials cached within 00705 * @a auth_baton. 00706 * 00707 * @note This function does not affect persisted authentication 00708 * credential storage at all. It is merely a way to cause Subversion 00709 * to forget about credentials already fetched from a provider, 00710 * forcing them to be fetched again later should they be required. 00711 * 00712 * @since New in 1.8. 00713 */ 00714 svn_error_t * 00715 svn_auth_forget_credentials(svn_auth_baton_t *auth_baton, 00716 const char *cred_kind, 00717 const char *realmstring, 00718 apr_pool_t *pool); 00719 00720 /** @} */ 00721 00722 /** Set @a *provider to an authentication provider of type 00723 * svn_auth_cred_simple_t that gets information by prompting the user 00724 * with @a prompt_func and @a prompt_baton. Allocate @a *provider in 00725 * @a pool. 00726 * 00727 * If both @c SVN_AUTH_PARAM_DEFAULT_USERNAME and 00728 * @c SVN_AUTH_PARAM_DEFAULT_PASSWORD are defined as runtime 00729 * parameters in the @c auth_baton, then @a *provider will return the 00730 * default arguments when svn_auth_first_credentials() is called. If 00731 * svn_auth_first_credentials() fails, then @a *provider will 00732 * re-prompt @a retry_limit times (via svn_auth_next_credentials()). 00733 * For infinite retries, set @a retry_limit to value less than 0. 00734 * 00735 * @since New in 1.4. 00736 */ 00737 void 00738 svn_auth_get_simple_prompt_provider(svn_auth_provider_object_t **provider, 00739 svn_auth_simple_prompt_func_t prompt_func, 00740 void *prompt_baton, 00741 int retry_limit, 00742 apr_pool_t *pool); 00743 00744 00745 /** Set @a *provider to an authentication provider of type @c 00746 * svn_auth_cred_username_t that gets information by prompting the 00747 * user with @a prompt_func and @a prompt_baton. Allocate @a *provider 00748 * in @a pool. 00749 * 00750 * If @c SVN_AUTH_PARAM_DEFAULT_USERNAME is defined as a runtime 00751 * parameter in the @c auth_baton, then @a *provider will return the 00752 * default argument when svn_auth_first_credentials() is called. If 00753 * svn_auth_first_credentials() fails, then @a *provider will 00754 * re-prompt @a retry_limit times (via svn_auth_next_credentials()). 00755 * For infinite retries, set @a retry_limit to value less than 0. 00756 * 00757 * @since New in 1.4. 00758 */ 00759 void 00760 svn_auth_get_username_prompt_provider( 00761 svn_auth_provider_object_t **provider, 00762 svn_auth_username_prompt_func_t prompt_func, 00763 void *prompt_baton, 00764 int retry_limit, 00765 apr_pool_t *pool); 00766 00767 00768 /** Set @a *provider to an authentication provider of type @c 00769 * svn_auth_cred_simple_t that gets/sets information from the user's 00770 * ~/.subversion configuration directory. 00771 * 00772 * If the provider is going to save the password unencrypted, it calls @a 00773 * plaintext_prompt_func, passing @a prompt_baton, before saving the 00774 * password. 00775 * 00776 * If @a plaintext_prompt_func is NULL it is not called and the answer is 00777 * assumed to be TRUE. This matches the deprecated behaviour of storing 00778 * unencrypted passwords by default, and is only done this way for backward 00779 * compatibility reasons. 00780 * Client developers are highly encouraged to provide this callback 00781 * to ensure their users are made aware of the fact that their password 00782 * is going to be stored unencrypted. In the future, providers may 00783 * default to not storing the password unencrypted if this callback is NULL. 00784 * 00785 * Clients can however set the callback to NULL and set 00786 * SVN_AUTH_PARAM_STORE_PLAINTEXT_PASSWORDS to SVN_CONFIG_FALSE or 00787 * SVN_CONFIG_TRUE to enforce a certain behaviour. 00788 * 00789 * Allocate @a *provider in @a pool. 00790 * 00791 * If a default username or password is available, @a *provider will 00792 * honor them as well, and return them when 00793 * svn_auth_first_credentials() is called. (see @c 00794 * SVN_AUTH_PARAM_DEFAULT_USERNAME and @c 00795 * SVN_AUTH_PARAM_DEFAULT_PASSWORD). 00796 * 00797 * @since New in 1.6. 00798 */ 00799 void 00800 svn_auth_get_simple_provider2( 00801 svn_auth_provider_object_t **provider, 00802 svn_auth_plaintext_prompt_func_t plaintext_prompt_func, 00803 void *prompt_baton, 00804 apr_pool_t *pool); 00805 00806 /** Like svn_auth_get_simple_provider2, but without the ability to 00807 * call the svn_auth_plaintext_prompt_func_t callback, and the provider 00808 * always assumes that it is allowed to store the password in plaintext. 00809 * 00810 * @deprecated Provided for backwards compatibility with the 1.5 API. 00811 * @since New in 1.4. 00812 */ 00813 SVN_DEPRECATED 00814 void 00815 svn_auth_get_simple_provider(svn_auth_provider_object_t **provider, 00816 apr_pool_t *pool); 00817 00818 /** Set @a *provider to an authentication provider of type @c 00819 * svn_auth_provider_object_t, or return @c NULL if the provider is not 00820 * available for the requested platform or the requested provider is unknown. 00821 * 00822 * Valid @a provider_name values are: "gnome_keyring", "keychain", "kwallet", 00823 * "gpg_agent", and "windows". 00824 * 00825 * Valid @a provider_type values are: "simple", "ssl_client_cert_pw" and 00826 * "ssl_server_trust". 00827 * 00828 * Allocate @a *provider in @a pool. 00829 * 00830 * What actually happens is we invoke the appropriate provider function to 00831 * supply the @a provider, like so: 00832 * 00833 * svn_auth_get_<name>_<type>_provider(@a provider, @a pool); 00834 * 00835 * @since New in 1.6. 00836 */ 00837 svn_error_t * 00838 svn_auth_get_platform_specific_provider( 00839 svn_auth_provider_object_t **provider, 00840 const char *provider_name, 00841 const char *provider_type, 00842 apr_pool_t *pool); 00843 00844 /** Set @a *providers to an array of <tt>svn_auth_provider_object_t *</tt> 00845 * objects. 00846 * Only client authentication providers available for the current platform are 00847 * returned. Order of the platform-specific authentication providers is 00848 * determined by the 'password-stores' configuration option which is retrieved 00849 * from @a config. @a config can be NULL. 00850 * 00851 * Create and allocate @a *providers in @a pool. 00852 * 00853 * Default order of the platform-specific authentication providers: 00854 * 1. gnome-keyring 00855 * 2. kwallet 00856 * 3. keychain 00857 * 4. gpg-agent 00858 * 5. windows-cryptoapi 00859 * 00860 * @since New in 1.6. 00861 */ 00862 svn_error_t * 00863 svn_auth_get_platform_specific_client_providers( 00864 apr_array_header_t **providers, 00865 svn_config_t *config, 00866 apr_pool_t *pool); 00867 00868 #if (defined(WIN32) && !defined(__MINGW32__)) || defined(DOXYGEN) 00869 /** 00870 * Set @a *provider to an authentication provider of type @c 00871 * svn_auth_cred_simple_t that gets/sets information from the user's 00872 * ~/.subversion configuration directory. Allocate @a *provider in 00873 * @a pool. 00874 * 00875 * This is like svn_auth_get_simple_provider(), except that, when 00876 * running on Window 2000 or newer (or any other Windows version that 00877 * includes the CryptoAPI), the provider encrypts the password before 00878 * storing it to disk. On earlier versions of Windows, the provider 00879 * does nothing. 00880 * 00881 * @since New in 1.4. 00882 * @note This function is only available on Windows. 00883 * 00884 * @note An administrative password reset may invalidate the account's 00885 * secret key. This function will detect that situation and behave as 00886 * if the password were not cached at all. 00887 */ 00888 void 00889 svn_auth_get_windows_simple_provider(svn_auth_provider_object_t **provider, 00890 apr_pool_t *pool); 00891 00892 /** 00893 * Set @a *provider to an authentication provider of type @c 00894 * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the 00895 * user's ~/.subversion configuration directory. Allocate @a *provider in 00896 * @a pool. 00897 * 00898 * This is like svn_auth_get_ssl_client_cert_pw_file_provider(), except that 00899 * when running on Window 2000 or newer, the provider encrypts the password 00900 * before storing it to disk. On earlier versions of Windows, the provider 00901 * does nothing. 00902 * 00903 * @since New in 1.6 00904 * @note This function is only available on Windows. 00905 * 00906 * @note An administrative password reset may invalidate the account's 00907 * secret key. This function will detect that situation and behave as 00908 * if the password were not cached at all. 00909 */ 00910 void 00911 svn_auth_get_windows_ssl_client_cert_pw_provider( 00912 svn_auth_provider_object_t **provider, 00913 apr_pool_t *pool); 00914 00915 /** 00916 * Set @a *provider to an authentication provider of type @c 00917 * svn_auth_cred_ssl_server_trust_t, allocated in @a pool. 00918 * 00919 * This provider automatically validates ssl server certificates with 00920 * the CryptoApi, like Internet Explorer and the Windows network API do. 00921 * This allows the rollout of root certificates via Windows Domain 00922 * policies, instead of Subversion specific configuration. 00923 * 00924 * @since New in 1.5. 00925 * @note This function is only available on Windows. 00926 */ 00927 void 00928 svn_auth_get_windows_ssl_server_trust_provider( 00929 svn_auth_provider_object_t **provider, 00930 apr_pool_t *pool); 00931 00932 #endif /* WIN32 && !__MINGW32__ || DOXYGEN */ 00933 00934 #if defined(DARWIN) || defined(DOXYGEN) 00935 /** 00936 * Set @a *provider to an authentication provider of type @c 00937 * svn_auth_cred_simple_t that gets/sets information from the user's 00938 * ~/.subversion configuration directory. Allocate @a *provider in 00939 * @a pool. 00940 * 00941 * This is like svn_auth_get_simple_provider(), except that the 00942 * password is stored in the Mac OS KeyChain. 00943 * 00944 * @since New in 1.4 00945 * @note This function is only available on Mac OS 10.2 and higher. 00946 */ 00947 void 00948 svn_auth_get_keychain_simple_provider(svn_auth_provider_object_t **provider, 00949 apr_pool_t *pool); 00950 00951 /** 00952 * Set @a *provider to an authentication provider of type @c 00953 * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the 00954 * user's ~/.subversion configuration directory. Allocate @a *provider in 00955 * @a pool. 00956 * 00957 * This is like svn_auth_get_ssl_client_cert_pw_file_provider(), except 00958 * that the password is stored in the Mac OS KeyChain. 00959 * 00960 * @since New in 1.6 00961 * @note This function is only available on Mac OS 10.2 and higher. 00962 */ 00963 void 00964 svn_auth_get_keychain_ssl_client_cert_pw_provider( 00965 svn_auth_provider_object_t **provider, 00966 apr_pool_t *pool); 00967 #endif /* DARWIN || DOXYGEN */ 00968 00969 #if (!defined(DARWIN) && !defined(WIN32)) || defined(DOXYGEN) 00970 /** A type of callback function for obtaining the GNOME Keyring password. 00971 * 00972 * In this callback, the client should ask the user for default keyring 00973 * @a keyring_name password. 00974 * 00975 * The answer is returned in @a *keyring_password. 00976 * @a baton is an implementation-specific closure. 00977 * All allocations should be done in @a pool. 00978 * 00979 * @since New in 1.6 00980 */ 00981 typedef svn_error_t *(*svn_auth_gnome_keyring_unlock_prompt_func_t)( 00982 char **keyring_password, 00983 const char *keyring_name, 00984 void *baton, 00985 apr_pool_t *pool); 00986 00987 00988 /** libsvn_auth_gnome_keyring-specific run-time parameters. */ 00989 00990 /** @brief The pointer to function which prompts user for GNOME Keyring 00991 * password. 00992 * The type of this pointer should be svn_auth_gnome_keyring_unlock_prompt_func_t. */ 00993 #define SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC "gnome-keyring-unlock-prompt-func" 00994 00995 /** @brief The baton which is passed to 00996 * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC. */ 00997 #define SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_BATON "gnome-keyring-unlock-prompt-baton" 00998 00999 01000 /** 01001 * Get libsvn_auth_gnome_keyring version information. 01002 * 01003 * @since New in 1.6 01004 */ 01005 const svn_version_t * 01006 svn_auth_gnome_keyring_version(void); 01007 01008 01009 /** 01010 * Set @a *provider to an authentication provider of type @c 01011 * svn_auth_cred_simple_t that gets/sets information from the user's 01012 * ~/.subversion configuration directory. 01013 * 01014 * This is like svn_client_get_simple_provider(), except that the 01015 * password is stored in GNOME Keyring. 01016 * 01017 * If the GNOME Keyring is locked the provider calls 01018 * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC in order to unlock 01019 * the keyring. 01020 * 01021 * @c SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_BATON is passed to 01022 * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC. 01023 * 01024 * Allocate @a *provider in @a pool. 01025 * 01026 * @since New in 1.6 01027 * @note This function actually works only on systems with 01028 * libsvn_auth_gnome_keyring and GNOME Keyring installed. 01029 */ 01030 void 01031 svn_auth_get_gnome_keyring_simple_provider( 01032 svn_auth_provider_object_t **provider, 01033 apr_pool_t *pool); 01034 01035 01036 /** 01037 * Set @a *provider to an authentication provider of type @c 01038 * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the 01039 * user's ~/.subversion configuration directory. 01040 * 01041 * This is like svn_client_get_ssl_client_cert_pw_file_provider(), except 01042 * that the password is stored in GNOME Keyring. 01043 * 01044 * If the GNOME Keyring is locked the provider calls 01045 * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC in order to unlock 01046 * the keyring. 01047 * 01048 * @c SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_BATON is passed to 01049 * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC. 01050 * 01051 * Allocate @a *provider in @a pool. 01052 * 01053 * @since New in 1.6 01054 * @note This function actually works only on systems with 01055 * libsvn_auth_gnome_keyring and GNOME Keyring installed. 01056 */ 01057 void 01058 svn_auth_get_gnome_keyring_ssl_client_cert_pw_provider( 01059 svn_auth_provider_object_t **provider, 01060 apr_pool_t *pool); 01061 01062 01063 /** 01064 * Get libsvn_auth_kwallet version information. 01065 * 01066 * @since New in 1.6 01067 */ 01068 const svn_version_t * 01069 svn_auth_kwallet_version(void); 01070 01071 01072 /** 01073 * Set @a *provider to an authentication provider of type @c 01074 * svn_auth_cred_simple_t that gets/sets information from the user's 01075 * ~/.subversion configuration directory. Allocate @a *provider in 01076 * @a pool. 01077 * 01078 * This is like svn_client_get_simple_provider(), except that the 01079 * password is stored in KWallet. 01080 * 01081 * @since New in 1.6 01082 * @note This function actually works only on systems with libsvn_auth_kwallet 01083 * and KWallet installed. 01084 */ 01085 void 01086 svn_auth_get_kwallet_simple_provider(svn_auth_provider_object_t **provider, 01087 apr_pool_t *pool); 01088 01089 01090 /** 01091 * Set @a *provider to an authentication provider of type @c 01092 * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the 01093 * user's ~/.subversion configuration directory. Allocate @a *provider in 01094 * @a pool. 01095 * 01096 * This is like svn_client_get_ssl_client_cert_pw_file_provider(), except 01097 * that the password is stored in KWallet. 01098 * 01099 * @since New in 1.6 01100 * @note This function actually works only on systems with libsvn_auth_kwallet 01101 * and KWallet installed. 01102 */ 01103 void 01104 svn_auth_get_kwallet_ssl_client_cert_pw_provider( 01105 svn_auth_provider_object_t **provider, 01106 apr_pool_t *pool); 01107 #endif /* (!DARWIN && !WIN32) || DOXYGEN */ 01108 01109 #if !defined(WIN32) || defined(DOXYGEN) 01110 /** 01111 * Set @a *provider to an authentication provider of type @c 01112 * svn_auth_cred_simple_t that gets/sets information from the user's 01113 * ~/.subversion configuration directory. 01114 * 01115 * This is like svn_client_get_simple_provider(), except that the 01116 * password is obtained from gpg_agent, which will keep it in 01117 * a memory cache. 01118 * 01119 * Allocate @a *provider in @a pool. 01120 * 01121 * @since New in 1.8 01122 * @note This function actually works only on systems with 01123 * GNU Privacy Guard installed. 01124 */ 01125 void 01126 svn_auth_get_gpg_agent_simple_provider 01127 (svn_auth_provider_object_t **provider, 01128 apr_pool_t *pool); 01129 #endif /* !defined(WIN32) || defined(DOXYGEN) */ 01130 01131 01132 /** Set @a *provider to an authentication provider of type @c 01133 * svn_auth_cred_username_t that gets/sets information from a user's 01134 * ~/.subversion configuration directory. Allocate @a *provider in 01135 * @a pool. 01136 * 01137 * If a default username is available, @a *provider will honor it, 01138 * and return it when svn_auth_first_credentials() is called. (See 01139 * @c SVN_AUTH_PARAM_DEFAULT_USERNAME.) 01140 * 01141 * @since New in 1.4. 01142 */ 01143 void 01144 svn_auth_get_username_provider(svn_auth_provider_object_t **provider, 01145 apr_pool_t *pool); 01146 01147 01148 /** Set @a *provider to an authentication provider of type @c 01149 * svn_auth_cred_ssl_server_trust_t, allocated in @a pool. 01150 * 01151 * @a *provider retrieves its credentials from the configuration 01152 * mechanism. The returned credential is used to override SSL 01153 * security on an error. 01154 * 01155 * @since New in 1.4. 01156 */ 01157 void 01158 svn_auth_get_ssl_server_trust_file_provider( 01159 svn_auth_provider_object_t **provider, 01160 apr_pool_t *pool); 01161 01162 /** Set @a *provider to an authentication provider of type @c 01163 * svn_auth_cred_ssl_client_cert_t, allocated in @a pool. 01164 * 01165 * @a *provider retrieves its credentials from the configuration 01166 * mechanism. The returned credential is used to load the appropriate 01167 * client certificate for authentication when requested by a server. 01168 * 01169 * @since New in 1.4. 01170 */ 01171 void 01172 svn_auth_get_ssl_client_cert_file_provider( 01173 svn_auth_provider_object_t **provider, 01174 apr_pool_t *pool); 01175 01176 01177 /** Set @a *provider to an authentication provider of type @c 01178 * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the user's 01179 * ~/.subversion configuration directory. 01180 * 01181 * If the provider is going to save the passphrase unencrypted, 01182 * it calls @a plaintext_passphrase_prompt_func, passing @a 01183 * prompt_baton, before saving the passphrase. 01184 * 01185 * If @a plaintext_passphrase_prompt_func is NULL it is not called 01186 * and the passphrase is not stored in plaintext. 01187 * Client developers are highly encouraged to provide this callback 01188 * to ensure their users are made aware of the fact that their passphrase 01189 * is going to be stored unencrypted. 01190 * 01191 * Clients can however set the callback to NULL and set 01192 * SVN_AUTH_PARAM_STORE_SSL_CLIENT_CERT_PP_PLAINTEXT to SVN_CONFIG_FALSE or 01193 * SVN_CONFIG_TRUE to enforce a certain behaviour. 01194 * 01195 * Allocate @a *provider in @a pool. 01196 * 01197 * @since New in 1.6. 01198 */ 01199 void 01200 svn_auth_get_ssl_client_cert_pw_file_provider2( 01201 svn_auth_provider_object_t **provider, 01202 svn_auth_plaintext_passphrase_prompt_func_t plaintext_passphrase_prompt_func, 01203 void *prompt_baton, 01204 apr_pool_t *pool); 01205 01206 /** Like svn_auth_get_ssl_client_cert_pw_file_provider2, but without 01207 * the ability to call the svn_auth_plaintext_passphrase_prompt_func_t 01208 * callback, and the provider always assumes that it is not allowed 01209 * to store the passphrase in plaintext. 01210 * 01211 * @deprecated Provided for backwards compatibility with the 1.5 API. 01212 * @since New in 1.4. 01213 */ 01214 SVN_DEPRECATED 01215 void 01216 svn_auth_get_ssl_client_cert_pw_file_provider( 01217 svn_auth_provider_object_t **provider, 01218 apr_pool_t *pool); 01219 01220 01221 /** Set @a *provider to an authentication provider of type @c 01222 * svn_auth_cred_ssl_server_trust_t, allocated in @a pool. 01223 * 01224 * @a *provider retrieves its credentials by using the @a prompt_func 01225 * and @a prompt_baton. The returned credential is used to override 01226 * SSL security on an error. 01227 * 01228 * @since New in 1.4. 01229 */ 01230 void 01231 svn_auth_get_ssl_server_trust_prompt_provider( 01232 svn_auth_provider_object_t **provider, 01233 svn_auth_ssl_server_trust_prompt_func_t prompt_func, 01234 void *prompt_baton, 01235 apr_pool_t *pool); 01236 01237 01238 /** Set @a *provider to an authentication provider of type @c 01239 * svn_auth_cred_ssl_client_cert_t, allocated in @a pool. 01240 * 01241 * @a *provider retrieves its credentials by using the @a prompt_func 01242 * and @a prompt_baton. The returned credential is used to load the 01243 * appropriate client certificate for authentication when requested by 01244 * a server. The prompt will be retried @a retry_limit times. For 01245 * infinite retries, set @a retry_limit to value less than 0. 01246 * 01247 * @since New in 1.4. 01248 */ 01249 void 01250 svn_auth_get_ssl_client_cert_prompt_provider( 01251 svn_auth_provider_object_t **provider, 01252 svn_auth_ssl_client_cert_prompt_func_t prompt_func, 01253 void *prompt_baton, 01254 int retry_limit, 01255 apr_pool_t *pool); 01256 01257 01258 /** Set @a *provider to an authentication provider of type @c 01259 * svn_auth_cred_ssl_client_cert_pw_t, allocated in @a pool. 01260 * 01261 * @a *provider retrieves its credentials by using the @a prompt_func 01262 * and @a prompt_baton. The returned credential is used when a loaded 01263 * client certificate is protected by a passphrase. The prompt will 01264 * be retried @a retry_limit times. For infinite retries, set 01265 * @a retry_limit to value less than 0. 01266 * 01267 * @since New in 1.4. 01268 */ 01269 void 01270 svn_auth_get_ssl_client_cert_pw_prompt_provider( 01271 svn_auth_provider_object_t **provider, 01272 svn_auth_ssl_client_cert_pw_prompt_func_t prompt_func, 01273 void *prompt_baton, 01274 int retry_limit, 01275 apr_pool_t *pool); 01276 01277 01278 #ifdef __cplusplus 01279 } 01280 #endif /* __cplusplus */ 01281 01282 #endif /* SVN_AUTH_H */