- Main Page
- Related Pages
- Modules
- Data Structures
- Files

- File List
- Globals

# svn_auth.h

Go to the documentation of this file.

    00001 /**
    00002  * @copyright
    00003  * ====================================================================
    00004  *    Licensed to the Apache Software Foundation (ASF) under one
    00005  *    or more contributor license agreements.  See the NOTICE file
    00006  *    distributed with this work for additional information
    00007  *    regarding copyright ownership.  The ASF licenses this file
    00008  *    to you under the Apache License, Version 2.0 (the
    00009  *    "License"); you may not use this file except in compliance
    00010  *    with the License.  You may obtain a copy of the License at
    00011  *
    00012  *      http://www.apache.org/licenses/LICENSE-2.0
    00013  *
    00014  *    Unless required by applicable law or agreed to in writing,
    00015  *    software distributed under the License is distributed on an
    00016  *    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    00017  *    KIND, either express or implied.  See the License for the
    00018  *    specific language governing permissions and limitations
    00019  *    under the License.
    00020  * ====================================================================
    00021  * @endcopyright
    00022  *
    00023  * @file svn_auth.h
    00024  * @brief Subversion's authentication system
    00025  */
    00026
    00027 #ifndef SVN_AUTH_H
    00028 #define SVN_AUTH_H
    00029
    00030 #include <apr.h>
    00031 #include <apr_pools.h>
    00032 #include <apr_hash.h>
    00033 #include <apr_tables.h>
    00034
    00035 #include "svn_types.h"
    00036 #include "svn_config.h"
    00037
    00038 #ifdef __cplusplus
    00039 extern "C" {
    00040 #endif /* __cplusplus */
    00041
    00042 /** Overview of the svn authentication system.
    00043  *
    00044  * We define an authentication "provider" as a module that is able to
    00045  * return a specific set of credentials. (e.g. username/password,
    00046  * certificate, etc.)  Each provider implements a vtable that
    00047  *
    00048  * - can fetch initial credentials
    00049  * - can retry the fetch (or try to fetch something different)
    00050  * - can store the credentials for future use
    00051  *
    00052  * For any given type of credentials, there can exist any number of
    00053  * separate providers -- each provider has a different method of
    00054  * fetching. (i.e. from a disk store, by prompting the user, etc.)
    00055  *
    00056  * The application begins by creating an auth baton object, and
    00057  * "registers" some number of providers with the auth baton, in a
    00058  * specific order.  (For example, it may first register a
    00059  * username/password provider that looks in disk store, then register
    00060  * a username/password provider that prompts the user.)
    00061  *
    00062  * Later on, when any svn library is challenged, it asks the auth
    00063  * baton for the specific credentials.  If the initial credentials
    00064  * fail to authenticate, the caller keeps requesting new credentials.
    00065  * Under the hood, libsvn_auth effectively "walks" over each provider
    00066  * (in order of registry), one at a time, until all the providers have
    00067  * exhausted all their retry options.
    00068  *
    00069  * This system allows an application to flexibly define authentication
    00070  * behaviors (by changing registration order), and very easily write
    00071  * new authentication providers.
    00072  *
    00073  * An auth_baton also contains an internal hashtable of run-time
    00074  * parameters; any provider or library layer can set these run-time
    00075  * parameters at any time, so that the provider has access to the
    00076  * data.  (For example, certain run-time data may not be available
    00077  * until an authentication challenge is made.)  Each credential type
    00078  * must document the run-time parameters that are made available to
    00079  * its providers.
    00080  *
    00081  * @defgroup auth_fns Authentication functions
    00082  * @{
    00083  */
    00084
    00085
    00086 /** The type of a Subversion authentication object */
    00087 typedef struct svn_auth_baton_t svn_auth_baton_t;
    00088
    00089 /** The type of a Subversion authentication-iteration object */
    00090 typedef struct svn_auth_iterstate_t svn_auth_iterstate_t;
    00091
    00092
    00093 /** The main authentication "provider" vtable. */
    00094 typedef struct svn_auth_provider_t
    00095 {
    00096   /** The kind of credentials this provider knows how to retrieve. */
    00097   const char *cred_kind;
    00098
    00099   /** Get an initial set of credentials.
    00100    *
    00101    * Set @a *credentials to a set of valid credentials within @a
    00102    * realmstring, or NULL if no credentials are available.  Set @a
    00103    * *iter_baton to context that allows a subsequent call to @c
    00104    * next_credentials, in case the first credentials fail to
    00105    * authenticate.  @a provider_baton is general context for the
    00106    * vtable, @a parameters contains any run-time data that the
    00107    * provider may need, and @a realmstring comes from the
    00108    * svn_auth_first_credentials() call.
    00109    */
    00110   svn_error_t * (*first_credentials)(void **credentials,
    00111                                      void **iter_baton,
    00112                                      void *provider_baton,
    00113                                      apr_hash_t *parameters,
    00114                                      const char *realmstring,
    00115                                      apr_pool_t *pool);
    00116
    00117   /** Get a different set of credentials.
    00118    *
    00119    * Set @a *credentials to another set of valid credentials (using @a
    00120    * iter_baton as the context from previous call to first_credentials
    00121    * or next_credentials).  If no more credentials are available, set
    00122    * @a *credentials to NULL.  If the provider only has one set of
    00123    * credentials, this function pointer should simply be NULL. @a
    00124    * provider_baton is general context for the vtable, @a parameters
    00125    * contains any run-time data that the provider may need, and @a
    00126    * realmstring comes from the svn_auth_first_credentials() call.
    00127    */
    00128   svn_error_t * (*next_credentials)(void **credentials,
    00129                                     void *iter_baton,
    00130                                     void *provider_baton,
    00131                                     apr_hash_t *parameters,
    00132                                     const char *realmstring,
    00133                                     apr_pool_t *pool);
    00134
    00135   /** Save credentials.
    00136    *
    00137    * Store @a credentials for future use.  @a provider_baton is
    00138    * general context for the vtable, and @a parameters contains any
    00139    * run-time data the provider may need.  Set @a *saved to TRUE if
    00140    * the save happened, or FALSE if not.  The provider is not required
    00141    * to save; if it refuses or is unable to save for non-fatal
    00142    * reasons, return FALSE.  If the provider never saves data, then
    00143    * this function pointer should simply be NULL. @a realmstring comes
    00144    * from the svn_auth_first_credentials() call.
    00145    */
    00146   svn_error_t * (*save_credentials)(svn_boolean_t *saved,
    00147                                     void *credentials,
    00148                                     void *provider_baton,
    00149                                     apr_hash_t *parameters,
    00150                                     const char *realmstring,
    00151                                     apr_pool_t *pool);
    00152
    00153 } svn_auth_provider_t;
    00154
    00155
    00156 /** A provider object, ready to be put into an array and given to
    00157     svn_auth_open(). */
    00158 typedef struct svn_auth_provider_object_t
    00159 {
    00160   const svn_auth_provider_t *vtable;
    00161   void *provider_baton;
    00162
    00163 } svn_auth_provider_object_t;
    00164
    00165 /** The type of function returning authentication provider. */
    00166 typedef void (*svn_auth_simple_provider_func_t)(
    00167   svn_auth_provider_object_t **provider,
    00168   apr_pool_t *pool);
    00169
    00170
    00171 /** Specific types of credentials **/
    00172
    00173 /** Simple username/password pair credential kind.
    00174  *
    00175  * The following auth parameters are available to the providers:
    00176  *
    00177  * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_CONFIG (@c svn_config_t*)
    00178  * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS (@c svn_config_t*)
    00179  *
    00180  * The following auth parameters may be available to the providers:
    00181  *
    00182  * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*)
    00183  * - @c SVN_AUTH_PARAM_DEFAULT_USERNAME (@c char*)
    00184  * - @c SVN_AUTH_PARAM_DEFAULT_PASSWORD (@c char*)
    00185  */
    00186 #define SVN_AUTH_CRED_SIMPLE "svn.simple"
    00187
    00188 /** @c SVN_AUTH_CRED_SIMPLE credentials. */
    00189 typedef struct svn_auth_cred_simple_t
    00190 {
    00191   /** Username */
    00192   const char *username;
    00193   /** Password */
    00194   const char *password;
    00195   /** Indicates if the credentials may be saved (to disk). For example, a
    00196    * GUI prompt implementation with a remember password checkbox shall set
    00197    * @a may_save to TRUE if the checkbox is checked.
    00198    */
    00199   svn_boolean_t may_save;
    00200 } svn_auth_cred_simple_t;
    00201
    00202
    00203 /** Username credential kind.
    00204  *
    00205  * The following optional auth parameters are relevant to the providers:
    00206  *
    00207  * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*)
    00208  * - @c SVN_AUTH_PARAM_DEFAULT_USERNAME (@c char*)
    00209  */
    00210 #define SVN_AUTH_CRED_USERNAME "svn.username"
    00211
    00212 /** @c SVN_AUTH_CRED_USERNAME credentials. */
    00213 typedef struct svn_auth_cred_username_t
    00214 {
    00215   /** Username */
    00216   const char *username;
    00217   /** Indicates if the credentials may be saved (to disk). For example, a
    00218    * GUI prompt implementation with a remember username checkbox shall set
    00219    * @a may_save to TRUE if the checkbox is checked.
    00220    */
    00221   svn_boolean_t may_save;
    00222 } svn_auth_cred_username_t;
    00223
    00224
    00225 /** SSL client certificate credential type.
    00226  *
    00227  * The following auth parameters are available to the providers:
    00228  *
    00229  * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS (@c svn_config_t*)
    00230  * - @c SVN_AUTH_PARAM_SERVER_GROUP (@c char*)
    00231  *
    00232  * The following optional auth parameters are relevant to the providers:
    00233  *
    00234  * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*)
    00235  */
    00236 #define SVN_AUTH_CRED_SSL_CLIENT_CERT "svn.ssl.client-cert"
    00237
    00238 /** @c SVN_AUTH_CRED_SSL_CLIENT_CERT credentials. */
    00239 typedef struct svn_auth_cred_ssl_client_cert_t
    00240 {
    00241   /** Absolute path to the certificate file */
    00242   const char *cert_file;
    00243   /** Indicates if the credentials may be saved (to disk). For example, a
    00244    * GUI prompt implementation with a remember certificate checkbox shall
    00245    * set @a may_save to TRUE if the checkbox is checked.
    00246    */
    00247   svn_boolean_t may_save;
    00248 } svn_auth_cred_ssl_client_cert_t;
    00249
    00250
    00251 /** A function returning an SSL client certificate passphrase provider. */
    00252 typedef void (*svn_auth_ssl_client_cert_pw_provider_func_t)(
    00253   svn_auth_provider_object_t **provider,
    00254   apr_pool_t *pool);
    00255
    00256 /** SSL client certificate passphrase credential type.
    00257  *
    00258  * @note The realmstring used with this credential type must be a name that
    00259  * makes it possible for the user to identify the certificate.
    00260  *
    00261  * The following auth parameters are available to the providers:
    00262  *
    00263  * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_CONFIG (@c svn_config_t*)
    00264  * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS (@c svn_config_t*)
    00265  * - @c SVN_AUTH_PARAM_SERVER_GROUP (@c char*)
    00266  *
    00267  * The following optional auth parameters are relevant to the providers:
    00268  *
    00269  * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*)
    00270  */
    00271 #define SVN_AUTH_CRED_SSL_CLIENT_CERT_PW "svn.ssl.client-passphrase"
    00272
    00273 /** @c SVN_AUTH_CRED_SSL_CLIENT_CERT_PW credentials. */
    00274 typedef struct svn_auth_cred_ssl_client_cert_pw_t
    00275 {
    00276   /** Certificate password */
    00277   const char *password;
    00278   /** Indicates if the credentials may be saved (to disk). For example, a
    00279    * GUI prompt implementation with a remember password checkbox shall set
    00280    * @a may_save to TRUE if the checkbox is checked.
    00281    */
    00282   svn_boolean_t may_save;
    00283 } svn_auth_cred_ssl_client_cert_pw_t;
    00284
    00285
    00286 /** SSL server verification credential type.
    00287  *
    00288  * The following auth parameters are available to the providers:
    00289  *
    00290  * - @c SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS (@c svn_config_t*)
    00291  * - @c SVN_AUTH_PARAM_SERVER_GROUP (@c char*)
    00292  * - @c SVN_AUTH_PARAM_SSL_SERVER_FAILURES (@c apr_uint32_t*)
    00293  * - @c SVN_AUTH_PARAM_SSL_SERVER_CERT_INFO
    00294  *      (@c svn_auth_ssl_server_cert_info_t*)
    00295  *
    00296  * The following optional auth parameters are relevant to the providers:
    00297  *
    00298  * - @c SVN_AUTH_PARAM_NO_AUTH_CACHE (@c void*)
    00299  */
    00300 #define SVN_AUTH_CRED_SSL_SERVER_TRUST "svn.ssl.server"
    00301
    00302 /** SSL server certificate information used by @c
    00303  * SVN_AUTH_CRED_SSL_SERVER_TRUST providers.
    00304  */
    00305 typedef struct svn_auth_ssl_server_cert_info_t
    00306 {
    00307   /** Primary CN */
    00308   const char *hostname;
    00309   /** ASCII fingerprint */
    00310   const char *fingerprint;
    00311   /** ASCII date from which the certificate is valid */
    00312   const char *valid_from;
    00313   /** ASCII date until which the certificate is valid */
    00314   const char *valid_until;
    00315   /** DN of the certificate issuer */
    00316   const char *issuer_dname;
    00317   /** Base-64 encoded DER certificate representation */
    00318   const char *ascii_cert;
    00319 } svn_auth_ssl_server_cert_info_t;
    00320
    00321 /**
    00322  * Return a deep copy of @a info, allocated in @a pool.
    00323  *
    00324  * @since New in 1.3.
    00325  */
    00326 svn_auth_ssl_server_cert_info_t *
    00327 svn_auth_ssl_server_cert_info_dup(const svn_auth_ssl_server_cert_info_t *info,
    00328                                   apr_pool_t *pool);
    00329
    00330 /** @c SVN_AUTH_CRED_SSL_SERVER_TRUST credentials. */
    00331 typedef struct svn_auth_cred_ssl_server_trust_t
    00332 {
    00333   /** Indicates if the credentials may be saved (to disk). For example, a
    00334    * GUI prompt implementation with a checkbox to accept the certificate
    00335    * permanently shall set @a may_save to TRUE if the checkbox is checked.
    00336    */
    00337   svn_boolean_t may_save;
    00338   /** Bit mask of the accepted failures */
    00339   apr_uint32_t accepted_failures;
    00340 } svn_auth_cred_ssl_server_trust_t;
    00341
    00342
    00343
    00344 /** Credential-constructing prompt functions. **/
    00345
    00346 /** These exist so that different client applications can use
    00347  * different prompt mechanisms to supply the same credentials.  For
    00348  * example, if authentication requires a username and password, a
    00349  * command-line client's prompting function might prompt first for the
    00350  * username and then for the password, whereas a GUI client's would
    00351  * present a single dialog box asking for both, and a telepathic
    00352  * client's would read all the information directly from the user's
    00353  * mind.  All these prompting functions return the same type of
    00354  * credential, but the information used to construct the credential is
    00355  * gathered in an interface-specific way in each case.
    00356  */
    00357
    00358 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool.
    00359  * @a baton is an implementation-specific closure.
    00360  *
    00361  * If @a realm is non-NULL, maybe use it in the prompt string.
    00362  *
    00363  * If @a username is non-NULL, then the user might be prompted only
    00364  * for a password, but @a *cred would still be filled with both
    00365  * username and password.  For example, a typical usage would be to
    00366  * pass @a username on the first call, but then leave it NULL for
    00367  * subsequent calls, on the theory that if credentials failed, it's
    00368  * as likely to be due to incorrect username as incorrect password.
    00369  *
    00370  * If @a may_save is FALSE, the auth system does not allow the credentials
    00371  * to be saved (to disk). A prompt function shall not ask the user if the
    00372  * credentials shall be saved if @a may_save is FALSE. For example, a GUI
    00373  * client with a remember password checkbox would grey out the checkbox if
    00374  * @a may_save is FALSE.
    00375  */
    00376 typedef svn_error_t *(*svn_auth_simple_prompt_func_t)(
    00377   svn_auth_cred_simple_t **cred,
    00378   void *baton,
    00379   const char *realm,
    00380   const char *username,
    00381   svn_boolean_t may_save,
    00382   apr_pool_t *pool);
    00383
    00384
    00385 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool.
    00386  * @a baton is an implementation-specific closure.
    00387  *
    00388  * If @a realm is non-NULL, maybe use it in the prompt string.
    00389  *
    00390  * If @a may_save is FALSE, the auth system does not allow the credentials
    00391  * to be saved (to disk). A prompt function shall not ask the user if the
    00392  * credentials shall be saved if @a may_save is FALSE. For example, a GUI
    00393  * client with a remember username checkbox would grey out the checkbox if
    00394  * @a may_save is FALSE.
    00395  */
    00396 typedef svn_error_t *(*svn_auth_username_prompt_func_t)(
    00397   svn_auth_cred_username_t **cred,
    00398   void *baton,
    00399   const char *realm,
    00400   svn_boolean_t may_save,
    00401   apr_pool_t *pool);
    00402
    00403
    00404 /** @name SSL server certificate failure bits
    00405  *
    00406  * @note These values are stored in the on disk auth cache by the SSL
    00407  * server certificate auth provider, so the meaning of these bits must
    00408  * not be changed.
    00409  * @{
    00410  */
    00411 /** Certificate is not yet valid. */
    00412 #define SVN_AUTH_SSL_NOTYETVALID 0x00000001
    00413 /** Certificate has expired. */
    00414 #define SVN_AUTH_SSL_EXPIRED     0x00000002
    00415 /** Certificate's CN (hostname) does not match the remote hostname. */
    00416 #define SVN_AUTH_SSL_CNMISMATCH  0x00000004
    00417 /** @brief Certificate authority is unknown (i.e. not trusted) */
    00418 #define SVN_AUTH_SSL_UNKNOWNCA   0x00000008
    00419 /** @brief Other failure. This can happen if neon has introduced a new
    00420  * failure bit that we do not handle yet. */
    00421 #define SVN_AUTH_SSL_OTHER       0x40000000
    00422 /** @} */
    00423
    00424 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool.
    00425  * @a baton is an implementation-specific closure.
    00426  *
    00427  * @a cert_info is a structure describing the server cert that was
    00428  * presented to the client, and @a failures is a bitmask that
    00429  * describes exactly why the cert could not be automatically validated,
    00430  * composed from the constants SVN_AUTH_SSL_* (@c SVN_AUTH_SSL_NOTYETVALID
    00431  * etc.).  @a realm is a string that can be used in the prompt string.
    00432  *
    00433  * If @a may_save is FALSE, the auth system does not allow the credentials
    00434  * to be saved (to disk). A prompt function shall not ask the user if the
    00435  * credentials shall be saved if @a may_save is FALSE. For example, a GUI
    00436  * client with a trust permanently checkbox would grey out the checkbox if
    00437  * @a may_save is FALSE.
    00438  */
    00439 typedef svn_error_t *(*svn_auth_ssl_server_trust_prompt_func_t)(
    00440   svn_auth_cred_ssl_server_trust_t **cred,
    00441   void *baton,
    00442   const char *realm,
    00443   apr_uint32_t failures,
    00444   const svn_auth_ssl_server_cert_info_t *cert_info,
    00445   svn_boolean_t may_save,
    00446   apr_pool_t *pool);
    00447
    00448
    00449 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool.
    00450  * @a baton is an implementation-specific closure.  @a realm is a string
    00451  * that can be used in the prompt string.
    00452  *
    00453  * If @a may_save is FALSE, the auth system does not allow the credentials
    00454  * to be saved (to disk). A prompt function shall not ask the user if the
    00455  * credentials shall be saved if @a may_save is FALSE. For example, a GUI
    00456  * client with a remember certificate checkbox would grey out the checkbox
    00457  * if @a may_save is FALSE.
    00458  */
    00459 typedef svn_error_t *(*svn_auth_ssl_client_cert_prompt_func_t)(
    00460   svn_auth_cred_ssl_client_cert_t **cred,
    00461   void *baton,
    00462   const char *realm,
    00463   svn_boolean_t may_save,
    00464   apr_pool_t *pool);
    00465
    00466
    00467 /** Set @a *cred by prompting the user, allocating @a *cred in @a pool.
    00468  * @a baton is an implementation-specific closure.  @a realm is a string
    00469  * identifying the certificate, and can be used in the prompt string.
    00470  *
    00471  * If @a may_save is FALSE, the auth system does not allow the credentials
    00472  * to be saved (to disk). A prompt function shall not ask the user if the
    00473  * credentials shall be saved if @a may_save is FALSE. For example, a GUI
    00474  * client with a remember password checkbox would grey out the checkbox if
    00475  * @a may_save is FALSE.
    00476  */
    00477 typedef svn_error_t *(*svn_auth_ssl_client_cert_pw_prompt_func_t)(
    00478   svn_auth_cred_ssl_client_cert_pw_t **cred,
    00479   void *baton,
    00480   const char *realm,
    00481   svn_boolean_t may_save,
    00482   apr_pool_t *pool);
    00483
    00484 /** A type of callback function for asking whether storing a password to
    00485  * disk in plaintext is allowed.
    00486  *
    00487  * In this callback, the client should ask the user whether storing
    00488  * a password for the realm identified by @a realmstring to disk
    00489  * in plaintext is allowed.
    00490  *
    00491  * The answer is returned in @a *may_save_plaintext.
    00492  * @a baton is an implementation-specific closure.
    00493  * All allocations should be done in @a pool.
    00494  *
    00495  * @since New in 1.6
    00496  */
    00497 typedef svn_error_t *(*svn_auth_plaintext_prompt_func_t)(
    00498   svn_boolean_t *may_save_plaintext,
    00499   const char *realmstring,
    00500   void *baton,
    00501   apr_pool_t *pool);
    00502
    00503 /** A type of callback function for asking whether storing a passphrase to
    00504  * disk in plaintext is allowed.
    00505  *
    00506  * In this callback, the client should ask the user whether storing
    00507  * a passphrase for the realm identified by @a realmstring to disk
    00508  * in plaintext is allowed.
    00509  *
    00510  * The answer is returned in @a *may_save_plaintext.
    00511  * @a baton is an implementation-specific closure.
    00512  * All allocations should be done in @a pool.
    00513  *
    00514  * @since New in 1.6
    00515  */
    00516 typedef svn_error_t *(*svn_auth_plaintext_passphrase_prompt_func_t)(
    00517   svn_boolean_t *may_save_plaintext,
    00518   const char *realmstring,
    00519   void *baton,
    00520   apr_pool_t *pool);
    00521
    00522
    00523 /** Initialize an authentication system.
    00524  *
    00525  * Return an authentication object in @a *auth_baton (allocated in @a
    00526  * pool) that represents a particular instance of the svn
    00527  * authentication system.  @a providers is an array of @c
    00528  * svn_auth_provider_object_t pointers, already allocated in @a pool
    00529  * and intentionally ordered.  These pointers will be stored within @a
    00530  * *auth_baton, grouped by credential type, and searched in this exact
    00531  * order.
    00532  */
    00533 void
    00534 svn_auth_open(svn_auth_baton_t **auth_baton,
    00535               const apr_array_header_t *providers,
    00536               apr_pool_t *pool);
    00537
    00538 /** Set an authentication run-time parameter.
    00539  *
    00540  * Store @a name / @a value pair as a run-time parameter in @a
    00541  * auth_baton, making the data accessible to all providers.  @a name
    00542  * and @a value will NOT be duplicated into the auth_baton's pool.
    00543  * To delete a run-time parameter, pass NULL for @a value.
    00544  */
    00545 void
    00546 svn_auth_set_parameter(svn_auth_baton_t *auth_baton,
    00547                        const char *name,
    00548                        const void *value);
    00549
    00550 /** Get an authentication run-time parameter.
    00551  *
    00552  * Return a value for run-time parameter @a name from @a auth_baton.
    00553  * Return NULL if the parameter doesn't exist.
    00554  */
    00555 const void *
    00556 svn_auth_get_parameter(svn_auth_baton_t *auth_baton,
    00557                        const char *name);
    00558
    00559 /** Universal run-time parameters, made available to all providers.
    00560
    00561     If you are writing a new provider, then to be a "good citizen",
    00562     you should notice these global parameters!  Note that these
    00563     run-time params should be treated as read-only by providers; the
    00564     application is responsible for placing them into the auth_baton
    00565     hash. */
    00566
    00567 /** The auth-hash prefix indicating that the parameter is global. */
    00568 #define SVN_AUTH_PARAM_PREFIX "svn:auth:"
    00569
    00570 /**
    00571  * @name Default credentials defines
    00572  * Any 'default' credentials that came in through the application itself,
    00573  * (e.g. --username and --password options). Property values are
    00574  * const char *.
    00575  * @{ */
    00576 #define SVN_AUTH_PARAM_DEFAULT_USERNAME  SVN_AUTH_PARAM_PREFIX "username"
    00577 #define SVN_AUTH_PARAM_DEFAULT_PASSWORD  SVN_AUTH_PARAM_PREFIX "password"
    00578 /** @} */
    00579
    00580 /** @brief The application doesn't want any providers to prompt
    00581  * users. Property value is irrelevant; only property's existence
    00582  * matters. */
    00583 #define SVN_AUTH_PARAM_NON_INTERACTIVE  SVN_AUTH_PARAM_PREFIX "non-interactive"
    00584
    00585 /** @brief The application doesn't want any providers to save passwords
    00586  * to disk. Property value is irrelevant; only property's existence
    00587  * matters. */
    00588 #define SVN_AUTH_PARAM_DONT_STORE_PASSWORDS  SVN_AUTH_PARAM_PREFIX \
    00589                                                  "dont-store-passwords"
    00590
    00591 /** @brief Indicates whether providers may save passwords to disk in
    00592  * plaintext. Property value can be either SVN_CONFIG_TRUE,
    00593  * SVN_CONFIG_FALSE, or SVN_CONFIG_ASK. */
    00594 #define SVN_AUTH_PARAM_STORE_PLAINTEXT_PASSWORDS  SVN_AUTH_PARAM_PREFIX \
    00595                                                   "store-plaintext-passwords"
    00596
    00597 /** @brief The application doesn't want any providers to save passphrase
    00598  * to disk. Property value is irrelevant; only property's existence
    00599  * matters. */
    00600 #define SVN_AUTH_PARAM_DONT_STORE_SSL_CLIENT_CERT_PP \
    00601   SVN_AUTH_PARAM_PREFIX "dont-store-ssl-client-cert-pp"
    00602
    00603 /** @brief Indicates whether providers may save passphrase to disk in
    00604  * plaintext. Property value can be either SVN_CONFIG_TRUE,
    00605  * SVN_CONFIG_FALSE, or SVN_CONFIG_ASK. */
    00606 #define SVN_AUTH_PARAM_STORE_SSL_CLIENT_CERT_PP_PLAINTEXT \
    00607   SVN_AUTH_PARAM_PREFIX "store-ssl-client-cert-pp-plaintext"
    00608
    00609 /** @brief The application doesn't want any providers to save credentials
    00610  * to disk. Property value is irrelevant; only property's existence
    00611  * matters. */
    00612 #define SVN_AUTH_PARAM_NO_AUTH_CACHE  SVN_AUTH_PARAM_PREFIX "no-auth-cache"
    00613
    00614 /** @brief The following property is for SSL server cert providers. This
    00615  * provides a pointer to an @c apr_uint32_t containing the failures
    00616  * detected by the certificate validator. */
    00617 #define SVN_AUTH_PARAM_SSL_SERVER_FAILURES SVN_AUTH_PARAM_PREFIX \
    00618   "ssl:failures"
    00619
    00620 /** @brief The following property is for SSL server cert providers. This
    00621  * provides the cert info (svn_auth_ssl_server_cert_info_t). */
    00622 #define SVN_AUTH_PARAM_SSL_SERVER_CERT_INFO SVN_AUTH_PARAM_PREFIX \
    00623   "ssl:cert-info"
    00624
    00625 /** Some providers need access to the @c svn_config_t configuration. */
    00626 #define SVN_AUTH_PARAM_CONFIG_CATEGORY_CONFIG SVN_AUTH_PARAM_PREFIX "config-category-config"
    00627 #define SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS SVN_AUTH_PARAM_PREFIX "config-category-servers"
    00628
    00629 /** @deprecated Provided for backward compatibility with the 1.5 API. */
    00630 #define SVN_AUTH_PARAM_CONFIG SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS
    00631
    00632 /** The current server group. */
    00633 #define SVN_AUTH_PARAM_SERVER_GROUP SVN_AUTH_PARAM_PREFIX "server-group"
    00634
    00635 /** @brief A configuration directory that overrides the default
    00636  * ~/.subversion. */
    00637 #define SVN_AUTH_PARAM_CONFIG_DIR SVN_AUTH_PARAM_PREFIX "config-dir"
    00638
    00639 /** Get an initial set of credentials.
    00640  *
    00641  * Ask @a auth_baton to set @a *credentials to a set of credentials
    00642  * defined by @a cred_kind and valid within @a realmstring, or NULL if
    00643  * no credentials are available.  Otherwise, return an iteration state
    00644  * in @a *state, so that the caller can call
    00645  * svn_auth_next_credentials(), in case the first set of credentials
    00646  * fails to authenticate.
    00647  *
    00648  * Use @a pool to allocate @a *state, and for temporary allocation.
    00649  * Note that @a *credentials will be allocated in @a auth_baton's pool.
    00650  */
    00651 svn_error_t *
    00652 svn_auth_first_credentials(void **credentials,
    00653                            svn_auth_iterstate_t **state,
    00654                            const char *cred_kind,
    00655                            const char *realmstring,
    00656                            svn_auth_baton_t *auth_baton,
    00657                            apr_pool_t *pool);
    00658
    00659 /** Get another set of credentials, assuming previous ones failed to
    00660  * authenticate.
    00661  *
    00662  * Use @a state to fetch a different set of @a *credentials, as a
    00663  * follow-up to svn_auth_first_credentials() or
    00664  * svn_auth_next_credentials().  If no more credentials are available,
    00665  * set @a *credentials to NULL.
    00666  *
    00667  * Note that @a *credentials will be allocated in @c auth_baton's pool.
    00668  */
    00669 svn_error_t *
    00670 svn_auth_next_credentials(void **credentials,
    00671                           svn_auth_iterstate_t *state,
    00672                           apr_pool_t *pool);
    00673
    00674 /** Save a set of credentials.
    00675  *
    00676  * Ask @a state to store the most recently returned credentials,
    00677  * presumably because they successfully authenticated.
    00678  * All allocations should be done in @a pool.
    00679  *
    00680  * If no credentials were ever returned, do nothing.
    00681  */
    00682 svn_error_t *
    00683 svn_auth_save_credentials(svn_auth_iterstate_t *state,
    00684                           apr_pool_t *pool);
    00685
    00686 /** @} */
    00687
    00688 /** Set @a *provider to an authentication provider of type
    00689  * svn_auth_cred_simple_t that gets information by prompting the user
    00690  * with @a prompt_func and @a prompt_baton.  Allocate @a *provider in
    00691  * @a pool.
    00692  *
    00693  * If both @c SVN_AUTH_PARAM_DEFAULT_USERNAME and
    00694  * @c SVN_AUTH_PARAM_DEFAULT_PASSWORD are defined as runtime
    00695  * parameters in the @c auth_baton, then @a *provider will return the
    00696  * default arguments when svn_auth_first_credentials() is called.  If
    00697  * svn_auth_first_credentials() fails, then @a *provider will
    00698  * re-prompt @a retry_limit times (via svn_auth_next_credentials()).
    00699  * For infinite retries, set @a retry_limit to value less than 0.
    00700  *
    00701  * @since New in 1.4.
    00702  */
    00703 void
    00704 svn_auth_get_simple_prompt_provider(svn_auth_provider_object_t **provider,
    00705                                     svn_auth_simple_prompt_func_t prompt_func,
    00706                                     void *prompt_baton,
    00707                                     int retry_limit,
    00708                                     apr_pool_t *pool);
    00709
    00710
    00711 /** Set @a *provider to an authentication provider of type @c
    00712  * svn_auth_cred_username_t that gets information by prompting the
    00713  * user with @a prompt_func and @a prompt_baton.  Allocate @a *provider
    00714  * in @a pool.
    00715  *
    00716  * If @c SVN_AUTH_PARAM_DEFAULT_USERNAME is defined as a runtime
    00717  * parameter in the @c auth_baton, then @a *provider will return the
    00718  * default argument when svn_auth_first_credentials() is called.  If
    00719  * svn_auth_first_credentials() fails, then @a *provider will
    00720  * re-prompt @a retry_limit times (via svn_auth_next_credentials()).
    00721  * For infinite retries, set @a retry_limit to value less than 0.
    00722  *
    00723  * @since New in 1.4.
    00724  */
    00725 void
    00726 svn_auth_get_username_prompt_provider(
    00727   svn_auth_provider_object_t **provider,
    00728   svn_auth_username_prompt_func_t prompt_func,
    00729   void *prompt_baton,
    00730   int retry_limit,
    00731   apr_pool_t *pool);
    00732
    00733
    00734 /** Set @a *provider to an authentication provider of type @c
    00735  * svn_auth_cred_simple_t that gets/sets information from the user's
    00736  * ~/.subversion configuration directory.
    00737  *
    00738  * If the provider is going to save the password unencrypted, it calls @a
    00739  * plaintext_prompt_func, passing @a prompt_baton, before saving the
    00740  * password.
    00741  *
    00742  * If @a plaintext_prompt_func is NULL it is not called and the answer is
    00743  * assumed to be TRUE. This matches the deprecated behaviour of storing
    00744  * unencrypted passwords by default, and is only done this way for backward
    00745  * compatibility reasons.
    00746  * Client developers are highly encouraged to provide this callback
    00747  * to ensure their users are made aware of the fact that their password
    00748  * is going to be stored unencrypted. In the future, providers may
    00749  * default to not storing the password unencrypted if this callback is NULL.
    00750  *
    00751  * Clients can however set the callback to NULL and set
    00752  * SVN_AUTH_PARAM_STORE_PLAINTEXT_PASSWORDS to SVN_CONFIG_FALSE or
    00753  * SVN_CONFIG_TRUE to enforce a certain behaviour.
    00754  *
    00755  * Allocate @a *provider in @a pool.
    00756  *
    00757  * If a default username or password is available, @a *provider will
    00758  * honor them as well, and return them when
    00759  * svn_auth_first_credentials() is called.  (see @c
    00760  * SVN_AUTH_PARAM_DEFAULT_USERNAME and @c
    00761  * SVN_AUTH_PARAM_DEFAULT_PASSWORD).
    00762  *
    00763  * @since New in 1.6.
    00764  */
    00765 void
    00766 svn_auth_get_simple_provider2(
    00767   svn_auth_provider_object_t **provider,
    00768   svn_auth_plaintext_prompt_func_t plaintext_prompt_func,
    00769   void *prompt_baton,
    00770   apr_pool_t *pool);
    00771
    00772 /** Like svn_auth_get_simple_provider2, but without the ability to
    00773  * call the svn_auth_plaintext_prompt_func_t callback, and the provider
    00774  * always assumes that it is allowed to store the password in plaintext.
    00775  *
    00776  * @deprecated Provided for backwards compatibility with the 1.5 API.
    00777  * @since New in 1.4.
    00778  */
    00779 SVN_DEPRECATED
    00780 void
    00781 svn_auth_get_simple_provider(svn_auth_provider_object_t **provider,
    00782                              apr_pool_t *pool);
    00783
    00784 /** Set @a *provider to an authentication provider of type @c
    00785  * svn_auth_provider_object_t, or return @c NULL if the provider is not
    00786  * available for the requested platform or the requested provider is unknown.
    00787  *
    00788  * Valid @a provider_name values are: "gnome_keyring", "keychain", "kwallet"
    00789  * and "windows".
    00790  *
    00791  * Valid @a provider_type values are: "simple", "ssl_client_cert_pw" and
    00792  * "ssl_server_trust".
    00793  *
    00794  * Allocate @a *provider in @a pool.
    00795  *
    00796  * What actually happens is we invoke the appropriate provider function to
    00797  * supply the @a provider, like so:
    00798  *
    00799  *    svn_auth_get_<name>_<type>_provider(@a provider, @a pool);
    00800  *
    00801  * @since New in 1.6.
    00802  */
    00803 svn_error_t *
    00804 svn_auth_get_platform_specific_provider(
    00805   svn_auth_provider_object_t **provider,
    00806   const char *provider_name,
    00807   const char *provider_type,
    00808   apr_pool_t *pool);
    00809
    00810 /** Set @a *providers to an array of <tt>svn_auth_provider_object_t *</tt>
    00811  * objects.
    00812  * Only client authentication providers available for the current platform are
    00813  * returned. Order of the platform-specific authentication providers is
    00814  * determined by the 'password-stores' configuration option which is retrieved
    00815  * from @a config. @a config can be NULL.
    00816  *
    00817  * Create and allocate @a *providers in @a pool.
    00818  *
    00819  * Default order of the platform-specific authentication providers:
    00820  *   1. gnome-keyring
    00821  *   2. kwallet
    00822  *   3. keychain
    00823  *   4. windows-cryptoapi
    00824  *
    00825  * @since New in 1.6.
    00826  */
    00827 svn_error_t *
    00828 svn_auth_get_platform_specific_client_providers(
    00829   apr_array_header_t **providers,
    00830   svn_config_t *config,
    00831   apr_pool_t *pool);
    00832
    00833 #if (defined(WIN32) && !defined(__MINGW32__)) || defined(DOXYGEN)
    00834 /**
    00835  * Set @a *provider to an authentication provider of type @c
    00836  * svn_auth_cred_simple_t that gets/sets information from the user's
    00837  * ~/.subversion configuration directory.  Allocate @a *provider in
    00838  * @a pool.
    00839  *
    00840  * This is like svn_auth_get_simple_provider(), except that, when
    00841  * running on Window 2000 or newer (or any other Windows version that
    00842  * includes the CryptoAPI), the provider encrypts the password before
    00843  * storing it to disk. On earlier versions of Windows, the provider
    00844  * does nothing.
    00845  *
    00846  * @since New in 1.4.
    00847  * @note This function is only available on Windows.
    00848  *
    00849  * @note An administrative password reset may invalidate the account's
    00850  * secret key. This function will detect that situation and behave as
    00851  * if the password were not cached at all.
    00852  */
    00853 void
    00854 svn_auth_get_windows_simple_provider(svn_auth_provider_object_t **provider,
    00855                                      apr_pool_t *pool);
    00856
    00857 /**
    00858  * Set @a *provider to an authentication provider of type @c
    00859  * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the
    00860  * user's ~/.subversion configuration directory.  Allocate @a *provider in
    00861  * @a pool.
    00862  *
    00863  * This is like svn_auth_get_ssl_client_cert_pw_file_provider(), except that
    00864  * when running on Window 2000 or newer, the provider encrypts the password
    00865  * before storing it to disk. On earlier versions of Windows, the provider
    00866  * does nothing.
    00867  *
    00868  * @since New in 1.6
    00869  * @note This function is only available on Windows.
    00870  *
    00871  * @note An administrative password reset may invalidate the account's
    00872  * secret key. This function will detect that situation and behave as
    00873  * if the password were not cached at all.
    00874  */
    00875 void
    00876 svn_auth_get_windows_ssl_client_cert_pw_provider(
    00877   svn_auth_provider_object_t **provider,
    00878   apr_pool_t *pool);
    00879
    00880 /**
    00881  * Set @a *provider to an authentication provider of type @c
    00882  * svn_auth_cred_ssl_server_trust_t, allocated in @a pool.
    00883  *
    00884  * This provider automatically validates ssl server certificates with
    00885  * the CryptoApi, like Internet Explorer and the Windows network API do.
    00886  * This allows the rollout of root certificates via Windows Domain
    00887  * policies, instead of Subversion specific configuration.
    00888  *
    00889  * @since New in 1.5.
    00890  * @note This function is only available on Windows.
    00891  */
    00892 void
    00893 svn_auth_get_windows_ssl_server_trust_provider(
    00894   svn_auth_provider_object_t **provider,
    00895   apr_pool_t *pool);
    00896
    00897 #endif /* WIN32 && !__MINGW32__ || DOXYGEN */
    00898
    00899 #if defined(DARWIN) || defined(DOXYGEN)
    00900 /**
    00901  * Set @a *provider to an authentication provider of type @c
    00902  * svn_auth_cred_simple_t that gets/sets information from the user's
    00903  * ~/.subversion configuration directory.  Allocate @a *provider in
    00904  * @a pool.
    00905  *
    00906  * This is like svn_auth_get_simple_provider(), except that the
    00907  * password is stored in the Mac OS KeyChain.
    00908  *
    00909  * @since New in 1.4
    00910  * @note This function is only available on Mac OS 10.2 and higher.
    00911  */
    00912 void
    00913 svn_auth_get_keychain_simple_provider(svn_auth_provider_object_t **provider,
    00914                                       apr_pool_t *pool);
    00915
    00916 /**
    00917  * Set @a *provider to an authentication provider of type @c
    00918  * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the
    00919  * user's ~/.subversion configuration directory.  Allocate @a *provider in
    00920  * @a pool.
    00921  *
    00922  * This is like svn_auth_get_ssl_client_cert_pw_file_provider(), except
    00923  * that the password is stored in the Mac OS KeyChain.
    00924  *
    00925  * @since New in 1.6
    00926  * @note This function is only available on Mac OS 10.2 and higher.
    00927  */
    00928 void
    00929 svn_auth_get_keychain_ssl_client_cert_pw_provider(
    00930   svn_auth_provider_object_t **provider,
    00931   apr_pool_t *pool);
    00932 #endif /* DARWIN || DOXYGEN */
    00933
    00934 #if (!defined(DARWIN) && !defined(WIN32)) || defined(DOXYGEN)
    00935 /** A type of callback function for obtaining the GNOME Keyring password.
    00936  *
    00937  * In this callback, the client should ask the user for default keyring
    00938  * @a keyring_name password.
    00939  *
    00940  * The answer is returned in @a *keyring_password.
    00941  * @a baton is an implementation-specific closure.
    00942  * All allocations should be done in @a pool.
    00943  *
    00944  * @since New in 1.6
    00945  */
    00946 typedef svn_error_t *(*svn_auth_gnome_keyring_unlock_prompt_func_t)(
    00947   char **keyring_password,
    00948   const char *keyring_name,
    00949   void *baton,
    00950   apr_pool_t *pool);
    00951
    00952
    00953 /** libsvn_auth_gnome_keyring-specific run-time parameters. */
    00954
    00955 /** @brief The pointer to function which prompts user for GNOME Keyring
    00956  * password.
    00957  * The type of this pointer should be svn_auth_gnome_keyring_unlock_prompt_func_t. */
    00958 #define SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC "gnome-keyring-unlock-prompt-func"
    00959
    00960 /** @brief The baton which is passed to
    00961  * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC. */
    00962 #define SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_BATON "gnome-keyring-unlock-prompt-baton"
    00963
    00964
    00965 /**
    00966  * Get libsvn_auth_gnome_keyring version information.
    00967  *
    00968  * @since New in 1.6
    00969  */
    00970 const svn_version_t *
    00971 svn_auth_gnome_keyring_version(void);
    00972
    00973
    00974 /**
    00975  * Set @a *provider to an authentication provider of type @c
    00976  * svn_auth_cred_simple_t that gets/sets information from the user's
    00977  * ~/.subversion configuration directory.
    00978  *
    00979  * This is like svn_client_get_simple_provider(), except that the
    00980  * password is stored in GNOME Keyring.
    00981  *
    00982  * If the GNOME Keyring is locked the provider calls
    00983  * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC in order to unlock
    00984  * the keyring.
    00985  *
    00986  * @c SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_BATON is passed to
    00987  * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC.
    00988  *
    00989  * Allocate @a *provider in @a pool.
    00990  *
    00991  * @since New in 1.6
    00992  * @note This function actually works only on systems with
    00993  * libsvn_auth_gnome_keyring and GNOME Keyring installed.
    00994  */
    00995 void
    00996 svn_auth_get_gnome_keyring_simple_provider(
    00997   svn_auth_provider_object_t **provider,
    00998   apr_pool_t *pool);
    00999
    01000
    01001 /**
    01002  * Set @a *provider to an authentication provider of type @c
    01003  * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the
    01004  * user's ~/.subversion configuration directory.
    01005  *
    01006  * This is like svn_client_get_ssl_client_cert_pw_file_provider(), except
    01007  * that the password is stored in GNOME Keyring.
    01008  *
    01009  * If the GNOME Keyring is locked the provider calls
    01010  * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC in order to unlock
    01011  * the keyring.
    01012  *
    01013  * @c SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_BATON is passed to
    01014  * @c *SVN_AUTH_PARAM_GNOME_KEYRING_UNLOCK_PROMPT_FUNC.
    01015  *
    01016  * Allocate @a *provider in @a pool.
    01017  *
    01018  * @since New in 1.6
    01019  * @note This function actually works only on systems with
    01020  * libsvn_auth_gnome_keyring and GNOME Keyring installed.
    01021  */
    01022 void
    01023 svn_auth_get_gnome_keyring_ssl_client_cert_pw_provider(
    01024   svn_auth_provider_object_t **provider,
    01025   apr_pool_t *pool);
    01026
    01027
    01028 /**
    01029  * Get libsvn_auth_kwallet version information.
    01030  *
    01031  * @since New in 1.6
    01032  */
    01033 const svn_version_t *
    01034 svn_auth_kwallet_version(void);
    01035
    01036
    01037 /**
    01038  * Set @a *provider to an authentication provider of type @c
    01039  * svn_auth_cred_simple_t that gets/sets information from the user's
    01040  * ~/.subversion configuration directory.  Allocate @a *provider in
    01041  * @a pool.
    01042  *
    01043  * This is like svn_client_get_simple_provider(), except that the
    01044  * password is stored in KWallet.
    01045  *
    01046  * @since New in 1.6
    01047  * @note This function actually works only on systems with libsvn_auth_kwallet
    01048  * and KWallet installed.
    01049  */
    01050 void
    01051 svn_auth_get_kwallet_simple_provider(svn_auth_provider_object_t **provider,
    01052                                      apr_pool_t *pool);
    01053
    01054
    01055 /**
    01056  * Set @a *provider to an authentication provider of type @c
    01057  * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the
    01058  * user's ~/.subversion configuration directory.  Allocate @a *provider in
    01059  * @a pool.
    01060  *
    01061  * This is like svn_client_get_ssl_client_cert_pw_file_provider(), except
    01062  * that the password is stored in KWallet.
    01063  *
    01064  * @since New in 1.6
    01065  * @note This function actually works only on systems with libsvn_auth_kwallet
    01066  * and KWallet installed.
    01067  */
    01068 void
    01069 svn_auth_get_kwallet_ssl_client_cert_pw_provider(
    01070   svn_auth_provider_object_t **provider,
    01071   apr_pool_t *pool);
    01072 #endif /* (!DARWIN && !WIN32) || DOXYGEN */
    01073
    01074
    01075 /** Set @a *provider to an authentication provider of type @c
    01076  * svn_auth_cred_username_t that gets/sets information from a user's
    01077  * ~/.subversion configuration directory.  Allocate @a *provider in
    01078  * @a pool.
    01079  *
    01080  * If a default username is available, @a *provider will honor it,
    01081  * and return it when svn_auth_first_credentials() is called.  (See
    01082  * @c SVN_AUTH_PARAM_DEFAULT_USERNAME.)
    01083  *
    01084  * @since New in 1.4.
    01085  */
    01086 void
    01087 svn_auth_get_username_provider(svn_auth_provider_object_t **provider,
    01088                                apr_pool_t *pool);
    01089
    01090
    01091 /** Set @a *provider to an authentication provider of type @c
    01092  * svn_auth_cred_ssl_server_trust_t, allocated in @a pool.
    01093  *
    01094  * @a *provider retrieves its credentials from the configuration
    01095  * mechanism.  The returned credential is used to override SSL
    01096  * security on an error.
    01097  *
    01098  * @since New in 1.4.
    01099  */
    01100 void
    01101 svn_auth_get_ssl_server_trust_file_provider(
    01102   svn_auth_provider_object_t **provider,
    01103   apr_pool_t *pool);
    01104
    01105 /** Set @a *provider to an authentication provider of type @c
    01106  * svn_auth_cred_ssl_client_cert_t, allocated in @a pool.
    01107  *
    01108  * @a *provider retrieves its credentials from the configuration
    01109  * mechanism.  The returned credential is used to load the appropriate
    01110  * client certificate for authentication when requested by a server.
    01111  *
    01112  * @since New in 1.4.
    01113  */
    01114 void
    01115 svn_auth_get_ssl_client_cert_file_provider(
    01116   svn_auth_provider_object_t **provider,
    01117   apr_pool_t *pool);
    01118
    01119
    01120 /** Set @a *provider to an authentication provider of type @c
    01121  * svn_auth_cred_ssl_client_cert_pw_t that gets/sets information from the user's
    01122  * ~/.subversion configuration directory.
    01123  *
    01124  * If the provider is going to save the passphrase unencrypted,
    01125  * it calls @a plaintext_passphrase_prompt_func, passing @a
    01126  * prompt_baton, before saving the passphrase.
    01127  *
    01128  * If @a plaintext_passphrase_prompt_func is NULL it is not called
    01129  * and the passphrase is not stored in plaintext.
    01130  * Client developers are highly encouraged to provide this callback
    01131  * to ensure their users are made aware of the fact that their passphrase
    01132  * is going to be stored unencrypted.
    01133  *
    01134  * Clients can however set the callback to NULL and set
    01135  * SVN_AUTH_PARAM_STORE_SSL_CLIENT_CERT_PP_PLAINTEXT to SVN_CONFIG_FALSE or
    01136  * SVN_CONFIG_TRUE to enforce a certain behaviour.
    01137  *
    01138  * Allocate @a *provider in @a pool.
    01139  *
    01140  * @since New in 1.6.
    01141  */
    01142 void
    01143 svn_auth_get_ssl_client_cert_pw_file_provider2(
    01144   svn_auth_provider_object_t **provider,
    01145   svn_auth_plaintext_passphrase_prompt_func_t plaintext_passphrase_prompt_func,
    01146   void *prompt_baton,
    01147   apr_pool_t *pool);
    01148
    01149 /** Like svn_auth_get_ssl_client_cert_pw_file_provider2, but without
    01150  * the ability to call the svn_auth_plaintext_passphrase_prompt_func_t
    01151  * callback, and the provider always assumes that it is not allowed
    01152  * to store the passphrase in plaintext.
    01153  *
    01154  * @deprecated Provided for backwards compatibility with the 1.5 API.
    01155  * @since New in 1.4.
    01156  */
    01157 SVN_DEPRECATED
    01158 void
    01159 svn_auth_get_ssl_client_cert_pw_file_provider(
    01160   svn_auth_provider_object_t **provider,
    01161   apr_pool_t *pool);
    01162
    01163
    01164 /** Set @a *provider to an authentication provider of type @c
    01165  * svn_auth_cred_ssl_server_trust_t, allocated in @a pool.
    01166  *
    01167  * @a *provider retrieves its credentials by using the @a prompt_func
    01168  * and @a prompt_baton.  The returned credential is used to override
    01169  * SSL security on an error.
    01170  *
    01171  * @since New in 1.4.
    01172  */
    01173 void
    01174 svn_auth_get_ssl_server_trust_prompt_provider(
    01175   svn_auth_provider_object_t **provider,
    01176   svn_auth_ssl_server_trust_prompt_func_t prompt_func,
    01177   void *prompt_baton,
    01178   apr_pool_t *pool);
    01179
    01180
    01181 /** Set @a *provider to an authentication provider of type @c
    01182  * svn_auth_cred_ssl_client_cert_t, allocated in @a pool.
    01183  *
    01184  * @a *provider retrieves its credentials by using the @a prompt_func
    01185  * and @a prompt_baton.  The returned credential is used to load the
    01186  * appropriate client certificate for authentication when requested by
    01187  * a server.  The prompt will be retried @a retry_limit times. For
    01188  * infinite retries, set @a retry_limit to value less than 0.
    01189  *
    01190  * @since New in 1.4.
    01191  */
    01192 void
    01193 svn_auth_get_ssl_client_cert_prompt_provider(
    01194   svn_auth_provider_object_t **provider,
    01195   svn_auth_ssl_client_cert_prompt_func_t prompt_func,
    01196   void *prompt_baton,
    01197   int retry_limit,
    01198   apr_pool_t *pool);
    01199
    01200
    01201 /** Set @a *provider to an authentication provider of type @c
    01202  * svn_auth_cred_ssl_client_cert_pw_t, allocated in @a pool.
    01203  *
    01204  * @a *provider retrieves its credentials by using the @a prompt_func
    01205  * and @a prompt_baton.  The returned credential is used when a loaded
    01206  * client certificate is protected by a passphrase.  The prompt will
    01207  * be retried @a retry_limit times. For infinite retries, set
    01208  * @a retry_limit to value less than 0.
    01209  *
    01210  * @since New in 1.4.
    01211  */
    01212 void
    01213 svn_auth_get_ssl_client_cert_pw_prompt_provider(
    01214   svn_auth_provider_object_t **provider,
    01215   svn_auth_ssl_client_cert_pw_prompt_func_t prompt_func,
    01216   void *prompt_baton,
    01217   int retry_limit,
    01218   apr_pool_t *pool);
    01219
    01220
    01221 #ifdef __cplusplus
    01222 }
    01223 #endif /* __cplusplus */
    01224
    01225 #endif /* SVN_AUTH_H */

All Data Structures Files Functions Variables Typedefs Enumerations Enumerator Defines