t/t5563-simple-http-auth.sh

   1 #!/bin/sh
   2
   3 test_description='test http auth header and credential helper interop'
   4
   5 TEST_PASSES_SANITIZE_LEAK=true
   6 . ./test-lib.sh
   7 . "$TEST_DIRECTORY"/lib-httpd.sh
   8
   9 enable_cgipassauth
  10 if ! test_have_prereq CGIPASSAUTH
  11 then
  12         skip_all="no CGIPassAuth support"
  13         test_done
  14 fi
  15 start_httpd
  16
  17 test_expect_success 'setup_credential_helper' '
  18         mkdir "$TRASH_DIRECTORY/bin" &&
  19         PATH=$PATH:"$TRASH_DIRECTORY/bin" &&
  20         export PATH &&
  21
  22         CREDENTIAL_HELPER="$TRASH_DIRECTORY/bin/git-credential-test-helper" &&
  23         write_script "$CREDENTIAL_HELPER" <<-\EOF
  24         cmd=$1
  25         teefile=$cmd-query-temp.cred
  26         catfile=$cmd-reply.cred
  27         sed -n -e "/^$/q" -e "p" >>$teefile
  28         state=$(sed -ne "s/^state\[\]=helper://p" "$teefile")
  29         if test -z "$state"
  30         then
  31                 mv "$teefile" "$cmd-query.cred"
  32         else
  33                 mv "$teefile" "$cmd-query-$state.cred"
  34                 catfile="$cmd-reply-$state.cred"
  35         fi
  36         if test "$cmd" = "get"
  37         then
  38                 cat $catfile
  39         fi
  40         EOF
  41 '
  42
  43 set_credential_reply () {
  44         local suffix="$(test -n "$2" && echo "-$2")"
  45         cat >"$TRASH_DIRECTORY/$1-reply$suffix.cred"
  46 }
  47
  48 expect_credential_query () {
  49         local suffix="$(test -n "$2" && echo "-$2")"
  50         cat >"$TRASH_DIRECTORY/$1-expect$suffix.cred" &&
  51         test_cmp "$TRASH_DIRECTORY/$1-expect$suffix.cred" \
  52                  "$TRASH_DIRECTORY/$1-query$suffix.cred"
  53 }
  54
  55 per_test_cleanup () {
  56         rm -f *.cred &&
  57         rm -f "$HTTPD_ROOT_PATH"/custom-auth.valid \
  58               "$HTTPD_ROOT_PATH"/custom-auth.challenge
  59 }
  60
  61 test_expect_success 'setup repository' '
  62         test_commit foo &&
  63         git init --bare "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
  64         git push --mirror "$HTTPD_DOCUMENT_ROOT_PATH/repo.git"
  65 '
  66
  67 test_expect_success 'access using basic auth' '
  68         test_when_finished "per_test_cleanup" &&
  69
  70         set_credential_reply get <<-EOF &&
  71         username=alice
  72         password=secret-passwd
  73         EOF
  74
  75         # Basic base64(alice:secret-passwd)
  76         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
  77         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
  78         EOF
  79
  80         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
  81         id=1 status=200
  82         id=default response=WWW-Authenticate: Basic realm="example.com"
  83         EOF
  84
  85         test_config_global credential.helper test-helper &&
  86         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
  87
  88         expect_credential_query get <<-EOF &&
  89         capability[]=authtype
  90         capability[]=state
  91         protocol=http
  92         host=$HTTPD_DEST
  93         wwwauth[]=Basic realm="example.com"
  94         EOF
  95
  96         expect_credential_query store <<-EOF
  97         protocol=http
  98         host=$HTTPD_DEST
  99         username=alice
 100         password=secret-passwd
 101         EOF
 102 '
 103
 104 test_expect_success 'access using basic auth via authtype' '
 105         test_when_finished "per_test_cleanup" &&
 106
 107         set_credential_reply get <<-EOF &&
 108         capability[]=authtype
 109         authtype=Basic
 110         credential=YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 111         EOF
 112
 113         # Basic base64(alice:secret-passwd)
 114         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 115         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 116         EOF
 117
 118         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 119         id=1 status=200
 120         id=default response=WWW-Authenticate: Basic realm="example.com"
 121         EOF
 122
 123         test_config_global credential.helper test-helper &&
 124         GIT_CURL_VERBOSE=1 git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 125
 126         expect_credential_query get <<-EOF &&
 127         capability[]=authtype
 128         capability[]=state
 129         protocol=http
 130         host=$HTTPD_DEST
 131         wwwauth[]=Basic realm="example.com"
 132         EOF
 133
 134         expect_credential_query store <<-EOF
 135         capability[]=authtype
 136         authtype=Basic
 137         credential=YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 138         protocol=http
 139         host=$HTTPD_DEST
 140         EOF
 141 '
 142
 143 test_expect_success 'access using basic auth invalid credentials' '
 144         test_when_finished "per_test_cleanup" &&
 145
 146         set_credential_reply get <<-EOF &&
 147         username=baduser
 148         password=wrong-passwd
 149         EOF
 150
 151         # Basic base64(alice:secret-passwd)
 152         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 153         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 154         EOF
 155
 156         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 157         id=1 status=200
 158         id=default response=WWW-Authenticate: Basic realm="example.com"
 159         EOF
 160
 161         test_config_global credential.helper test-helper &&
 162         test_must_fail git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 163
 164         expect_credential_query get <<-EOF &&
 165         capability[]=authtype
 166         capability[]=state
 167         protocol=http
 168         host=$HTTPD_DEST
 169         wwwauth[]=Basic realm="example.com"
 170         EOF
 171
 172         expect_credential_query erase <<-EOF
 173         protocol=http
 174         host=$HTTPD_DEST
 175         username=baduser
 176         password=wrong-passwd
 177         wwwauth[]=Basic realm="example.com"
 178         EOF
 179 '
 180
 181 test_expect_success 'access using basic proactive auth' '
 182         test_when_finished "per_test_cleanup" &&
 183
 184         set_credential_reply get <<-EOF &&
 185         username=alice
 186         password=secret-passwd
 187         EOF
 188
 189         # Basic base64(alice:secret-passwd)
 190         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 191         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 192         EOF
 193
 194         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 195         id=1 status=200
 196         id=default status=403
 197         EOF
 198
 199         test_config_global credential.helper test-helper &&
 200         test_config_global http.proactiveAuth basic &&
 201         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 202
 203         expect_credential_query get <<-EOF &&
 204         capability[]=authtype
 205         capability[]=state
 206         protocol=http
 207         host=$HTTPD_DEST
 208         wwwauth[]=Basic
 209         EOF
 210
 211         expect_credential_query store <<-EOF
 212         protocol=http
 213         host=$HTTPD_DEST
 214         username=alice
 215         password=secret-passwd
 216         EOF
 217 '
 218
 219 test_expect_success 'access using auto proactive auth with basic default' '
 220         test_when_finished "per_test_cleanup" &&
 221
 222         set_credential_reply get <<-EOF &&
 223         username=alice
 224         password=secret-passwd
 225         EOF
 226
 227         # Basic base64(alice:secret-passwd)
 228         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 229         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 230         EOF
 231
 232         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 233         id=1 status=200
 234         id=default status=403
 235         EOF
 236
 237         test_config_global credential.helper test-helper &&
 238         test_config_global http.proactiveAuth auto &&
 239         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 240
 241         expect_credential_query get <<-EOF &&
 242         capability[]=authtype
 243         capability[]=state
 244         protocol=http
 245         host=$HTTPD_DEST
 246         EOF
 247
 248         expect_credential_query store <<-EOF
 249         protocol=http
 250         host=$HTTPD_DEST
 251         username=alice
 252         password=secret-passwd
 253         EOF
 254 '
 255
 256 test_expect_success 'access using auto proactive auth with authtype from credential helper' '
 257         test_when_finished "per_test_cleanup" &&
 258
 259         set_credential_reply get <<-EOF &&
 260         capability[]=authtype
 261         authtype=Bearer
 262         credential=YS1naXQtdG9rZW4=
 263         EOF
 264
 265         # Basic base64(a-git-token)
 266         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 267         id=1 creds=Bearer YS1naXQtdG9rZW4=
 268         EOF
 269
 270         CHALLENGE="$HTTPD_ROOT_PATH/custom-auth.challenge" &&
 271
 272         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 273         id=1 status=200
 274         id=default status=403
 275         EOF
 276
 277         test_config_global credential.helper test-helper &&
 278         test_config_global http.proactiveAuth auto &&
 279         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 280
 281         expect_credential_query get <<-EOF &&
 282         capability[]=authtype
 283         capability[]=state
 284         protocol=http
 285         host=$HTTPD_DEST
 286         EOF
 287
 288         expect_credential_query store <<-EOF
 289         capability[]=authtype
 290         authtype=Bearer
 291         credential=YS1naXQtdG9rZW4=
 292         protocol=http
 293         host=$HTTPD_DEST
 294         EOF
 295 '
 296
 297 test_expect_success 'access using basic auth with extra challenges' '
 298         test_when_finished "per_test_cleanup" &&
 299
 300         set_credential_reply get <<-EOF &&
 301         username=alice
 302         password=secret-passwd
 303         EOF
 304
 305         # Basic base64(alice:secret-passwd)
 306         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 307         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 308         EOF
 309
 310         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 311         id=1 status=200
 312         id=default response=WWW-Authenticate: FooBar param1="value1" param2="value2"
 313         id=default response=WWW-Authenticate: Bearer authorize_uri="id.example.com" p=1 q=0
 314         id=default response=WWW-Authenticate: Basic realm="example.com"
 315         EOF
 316
 317         test_config_global credential.helper test-helper &&
 318         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 319
 320         expect_credential_query get <<-EOF &&
 321         capability[]=authtype
 322         capability[]=state
 323         protocol=http
 324         host=$HTTPD_DEST
 325         wwwauth[]=FooBar param1="value1" param2="value2"
 326         wwwauth[]=Bearer authorize_uri="id.example.com" p=1 q=0
 327         wwwauth[]=Basic realm="example.com"
 328         EOF
 329
 330         expect_credential_query store <<-EOF
 331         protocol=http
 332         host=$HTTPD_DEST
 333         username=alice
 334         password=secret-passwd
 335         EOF
 336 '
 337
 338 test_expect_success 'access using basic auth mixed-case wwwauth header name' '
 339         test_when_finished "per_test_cleanup" &&
 340
 341         set_credential_reply get <<-EOF &&
 342         username=alice
 343         password=secret-passwd
 344         EOF
 345
 346         # Basic base64(alice:secret-passwd)
 347         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 348         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 349         EOF
 350
 351         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 352         id=1 status=200
 353         id=default response=www-authenticate: foobar param1="value1" param2="value2"
 354         id=default response=WWW-AUTHENTICATE: BEARER authorize_uri="id.example.com" p=1 q=0
 355         id=default response=WwW-aUtHeNtIcAtE: baSiC realm="example.com"
 356         EOF
 357
 358         test_config_global credential.helper test-helper &&
 359         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 360
 361         expect_credential_query get <<-EOF &&
 362         capability[]=authtype
 363         capability[]=state
 364         protocol=http
 365         host=$HTTPD_DEST
 366         wwwauth[]=foobar param1="value1" param2="value2"
 367         wwwauth[]=BEARER authorize_uri="id.example.com" p=1 q=0
 368         wwwauth[]=baSiC realm="example.com"
 369         EOF
 370
 371         expect_credential_query store <<-EOF
 372         protocol=http
 373         host=$HTTPD_DEST
 374         username=alice
 375         password=secret-passwd
 376         EOF
 377 '
 378
 379 test_expect_success 'access using basic auth with wwwauth header continuations' '
 380         test_when_finished "per_test_cleanup" &&
 381
 382         set_credential_reply get <<-EOF &&
 383         username=alice
 384         password=secret-passwd
 385         EOF
 386
 387         # Basic base64(alice:secret-passwd)
 388         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 389         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 390         EOF
 391
 392         # Note that leading and trailing whitespace is important to correctly
 393         # simulate a continuation/folded header.
 394         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 395         id=1 status=200
 396         id=default response=WWW-Authenticate: FooBar param1="value1"
 397         id=default response= param2="value2"
 398         id=default response=WWW-Authenticate: Bearer authorize_uri="id.example.com"
 399         id=default response= p=1
 400         id=default response= q=0
 401         id=default response=WWW-Authenticate: Basic realm="example.com"
 402         EOF
 403
 404         test_config_global credential.helper test-helper &&
 405         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 406
 407         expect_credential_query get <<-EOF &&
 408         capability[]=authtype
 409         capability[]=state
 410         protocol=http
 411         host=$HTTPD_DEST
 412         wwwauth[]=FooBar param1="value1" param2="value2"
 413         wwwauth[]=Bearer authorize_uri="id.example.com" p=1 q=0
 414         wwwauth[]=Basic realm="example.com"
 415         EOF
 416
 417         expect_credential_query store <<-EOF
 418         protocol=http
 419         host=$HTTPD_DEST
 420         username=alice
 421         password=secret-passwd
 422         EOF
 423 '
 424
 425 test_expect_success 'access using basic auth with wwwauth header empty continuations' '
 426         test_when_finished "per_test_cleanup" &&
 427
 428         set_credential_reply get <<-EOF &&
 429         username=alice
 430         password=secret-passwd
 431         EOF
 432
 433         # Basic base64(alice:secret-passwd)
 434         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 435         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 436         EOF
 437
 438         CHALLENGE="$HTTPD_ROOT_PATH/custom-auth.challenge" &&
 439
 440         # Note that leading and trailing whitespace is important to correctly
 441         # simulate a continuation/folded header.
 442         printf "id=1 status=200\n" >"$CHALLENGE" &&
 443         printf "id=default response=WWW-Authenticate: FooBar param1=\"value1\"\r\n" >>"$CHALLENGE" &&
 444         printf "id=default response= \r\n" >>"$CHALLENGE" &&
 445         printf "id=default response= param2=\"value2\"\r\n" >>"$CHALLENGE" &&
 446         printf "id=default response=WWW-Authenticate: Bearer authorize_uri=\"id.example.com\"\r\n" >>"$CHALLENGE" &&
 447         printf "id=default response= p=1\r\n" >>"$CHALLENGE" &&
 448         printf "id=default response= \r\n" >>"$CHALLENGE" &&
 449         printf "id=default response= q=0\r\n" >>"$CHALLENGE" &&
 450         printf "id=default response=WWW-Authenticate: Basic realm=\"example.com\"\r\n" >>"$CHALLENGE" &&
 451
 452         test_config_global credential.helper test-helper &&
 453         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 454
 455         expect_credential_query get <<-EOF &&
 456         capability[]=authtype
 457         capability[]=state
 458         protocol=http
 459         host=$HTTPD_DEST
 460         wwwauth[]=FooBar param1="value1" param2="value2"
 461         wwwauth[]=Bearer authorize_uri="id.example.com" p=1 q=0
 462         wwwauth[]=Basic realm="example.com"
 463         EOF
 464
 465         expect_credential_query store <<-EOF
 466         protocol=http
 467         host=$HTTPD_DEST
 468         username=alice
 469         password=secret-passwd
 470         EOF
 471 '
 472
 473 test_expect_success 'access using basic auth with wwwauth header mixed line-endings' '
 474         test_when_finished "per_test_cleanup" &&
 475
 476         set_credential_reply get <<-EOF &&
 477         username=alice
 478         password=secret-passwd
 479         EOF
 480
 481         # Basic base64(alice:secret-passwd)
 482         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 483         id=1 creds=Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
 484         EOF
 485
 486         CHALLENGE="$HTTPD_ROOT_PATH/custom-auth.challenge" &&
 487
 488         # Note that leading and trailing whitespace is important to correctly
 489         # simulate a continuation/folded header.
 490         printf "id=1 status=200\n" >"$CHALLENGE" &&
 491         printf "id=default response=WWW-Authenticate: FooBar param1=\"value1\"\r\n" >>"$CHALLENGE" &&
 492         printf "id=default response= \r\n" >>"$CHALLENGE" &&
 493         printf "id=default response=\tparam2=\"value2\"\r\n" >>"$CHALLENGE" &&
 494         printf "id=default response=WWW-Authenticate: Basic realm=\"example.com\"" >>"$CHALLENGE" &&
 495
 496         test_config_global credential.helper test-helper &&
 497         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 498
 499         expect_credential_query get <<-EOF &&
 500         capability[]=authtype
 501         capability[]=state
 502         protocol=http
 503         host=$HTTPD_DEST
 504         wwwauth[]=FooBar param1="value1" param2="value2"
 505         wwwauth[]=Basic realm="example.com"
 506         EOF
 507
 508         expect_credential_query store <<-EOF
 509         protocol=http
 510         host=$HTTPD_DEST
 511         username=alice
 512         password=secret-passwd
 513         EOF
 514 '
 515
 516 test_expect_success 'access using bearer auth' '
 517         test_when_finished "per_test_cleanup" &&
 518
 519         set_credential_reply get <<-EOF &&
 520         capability[]=authtype
 521         authtype=Bearer
 522         credential=YS1naXQtdG9rZW4=
 523         EOF
 524
 525         # Basic base64(a-git-token)
 526         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 527         id=1 creds=Bearer YS1naXQtdG9rZW4=
 528         EOF
 529
 530         CHALLENGE="$HTTPD_ROOT_PATH/custom-auth.challenge" &&
 531
 532         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 533         id=1 status=200
 534         id=default response=WWW-Authenticate: FooBar param1="value1" param2="value2"
 535         id=default response=WWW-Authenticate: Bearer authorize_uri="id.example.com" p=1 q=0
 536         id=default response=WWW-Authenticate: Basic realm="example.com"
 537         EOF
 538
 539         test_config_global credential.helper test-helper &&
 540         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 541
 542         expect_credential_query get <<-EOF &&
 543         capability[]=authtype
 544         capability[]=state
 545         protocol=http
 546         host=$HTTPD_DEST
 547         wwwauth[]=FooBar param1="value1" param2="value2"
 548         wwwauth[]=Bearer authorize_uri="id.example.com" p=1 q=0
 549         wwwauth[]=Basic realm="example.com"
 550         EOF
 551
 552         expect_credential_query store <<-EOF
 553         capability[]=authtype
 554         authtype=Bearer
 555         credential=YS1naXQtdG9rZW4=
 556         protocol=http
 557         host=$HTTPD_DEST
 558         EOF
 559 '
 560
 561 test_expect_success 'access using bearer auth with invalid credentials' '
 562         test_when_finished "per_test_cleanup" &&
 563
 564         set_credential_reply get <<-EOF &&
 565         capability[]=authtype
 566         authtype=Bearer
 567         credential=incorrect-token
 568         EOF
 569
 570         # Basic base64(a-git-token)
 571         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 572         id=1 creds=Bearer YS1naXQtdG9rZW4=
 573         EOF
 574
 575         CHALLENGE="$HTTPD_ROOT_PATH/custom-auth.challenge" &&
 576
 577         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 578         id=1 status=200
 579         id=default response=WWW-Authenticate: FooBar param1="value1" param2="value2"
 580         id=default response=WWW-Authenticate: Bearer authorize_uri="id.example.com" p=1 q=0
 581         id=default response=WWW-Authenticate: Basic realm="example.com"
 582         EOF
 583
 584         test_config_global credential.helper test-helper &&
 585         test_must_fail git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 586
 587         expect_credential_query get <<-EOF &&
 588         capability[]=authtype
 589         capability[]=state
 590         protocol=http
 591         host=$HTTPD_DEST
 592         wwwauth[]=FooBar param1="value1" param2="value2"
 593         wwwauth[]=Bearer authorize_uri="id.example.com" p=1 q=0
 594         wwwauth[]=Basic realm="example.com"
 595         EOF
 596
 597         expect_credential_query erase <<-EOF
 598         capability[]=authtype
 599         authtype=Bearer
 600         credential=incorrect-token
 601         protocol=http
 602         host=$HTTPD_DEST
 603         wwwauth[]=FooBar param1="value1" param2="value2"
 604         wwwauth[]=Bearer authorize_uri="id.example.com" p=1 q=0
 605         wwwauth[]=Basic realm="example.com"
 606         EOF
 607 '
 608
 609 test_expect_success 'access using three-legged auth' '
 610         test_when_finished "per_test_cleanup" &&
 611
 612         set_credential_reply get <<-EOF &&
 613         capability[]=authtype
 614         capability[]=state
 615         authtype=Multistage
 616         credential=YS1naXQtdG9rZW4=
 617         state[]=helper:foobar
 618         continue=1
 619         EOF
 620
 621         set_credential_reply get foobar <<-EOF &&
 622         capability[]=authtype
 623         capability[]=state
 624         authtype=Multistage
 625         credential=YW5vdGhlci10b2tlbg==
 626         state[]=helper:bazquux
 627         EOF
 628
 629         cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
 630         id=1 creds=Multistage YS1naXQtdG9rZW4=
 631         id=2 creds=Multistage YW5vdGhlci10b2tlbg==
 632         EOF
 633
 634         CHALLENGE="$HTTPD_ROOT_PATH/custom-auth.challenge" &&
 635
 636         cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
 637         id=1 status=401 response=WWW-Authenticate: Multistage challenge="456"
 638         id=1 status=401 response=WWW-Authenticate: Bearer authorize_uri="id.example.com" p=1 q=0
 639         id=2 status=200
 640         id=default response=WWW-Authenticate: Multistage challenge="123"
 641         id=default response=WWW-Authenticate: Bearer authorize_uri="id.example.com" p=1 q=0
 642         EOF
 643
 644         test_config_global credential.helper test-helper &&
 645         git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
 646
 647         expect_credential_query get <<-EOF &&
 648         capability[]=authtype
 649         capability[]=state
 650         protocol=http
 651         host=$HTTPD_DEST
 652         wwwauth[]=Multistage challenge="123"
 653         wwwauth[]=Bearer authorize_uri="id.example.com" p=1 q=0
 654         EOF
 655
 656         expect_credential_query get foobar <<-EOF &&
 657         capability[]=authtype
 658         capability[]=state
 659         authtype=Multistage
 660         protocol=http
 661         host=$HTTPD_DEST
 662         wwwauth[]=Multistage challenge="456"
 663         wwwauth[]=Bearer authorize_uri="id.example.com" p=1 q=0
 664         state[]=helper:foobar
 665         EOF
 666
 667         expect_credential_query store bazquux <<-EOF
 668         capability[]=authtype
 669         capability[]=state
 670         authtype=Multistage
 671         credential=YW5vdGhlci10b2tlbg==
 672         protocol=http
 673         host=$HTTPD_DEST
 674         state[]=helper:bazquux
 675         EOF
 676 '
 677
 678 test_done