在 Windows/Active Directory 环境中的服务器上配置 GIT
我们正在考虑配置 GIT 以供 Windows 客户端在 Active Directory 环境中使用，我想知道人们使用哪些配置取得了成功。
我们最初设置了 HTTPS/Apache，并针对 AD 进行了基本身份验证。但是，这要求为客户端的每次推送提供凭据。 Kerberos 会减轻痛苦吗？
我对使用 SSH 和私钥对持怀疑态度，因为这会增加我们 IT 团队所需的维护工作。是否有一种方法可以将私钥绑定到 AD 帐户，以便 git 自动获取私钥（某种与 AD 连接的 plink.exe 替代品）？
我基本上是在尽量减少 IT 团队和开发人员持续面临的痛苦。我是在浪费时间吗？我应该考虑 Mercurial 吗？
澄清一下：我有在 Windows 上使用 Git 并使用 github 作为远程的经验，我喜欢它。不过，如果 Mercurial 意味着 Windows 下有更好的身份验证支持，我很乐意考虑它（我已经使用过，但只使用了一点）。
We're looking at configuring GIT for use by Windows clients in an Active Directory environment and I'm wondering what configurations people have had success with.
We've initially set up HTTPS/Apache with Basic authentication against AD. However, this requires that credentials be supplied for every push from the client. Would Kerberos be less painful?
I'm dubious about using SSH and private key pairs as it will increase the maintenance required by our IT team. Is there perhaps a way of tying a private key to an AD account in a way that it can be picked up automatically by git (some kind of AD-connected plink.exe replacement)?
I'm basically trying to minimise on-going pain for both the IT team and the developers. Am I wasting my time? Should I be looking at Mercurial instead?
To clarify: I have experience with Git on Windows with github as a remote and I love it. However, I'm happy to look at Mercurial (which I've used, but only a little) if it means better authentication support under Windows.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
到底是什么问题呢？始终手动提供凭据？
如果您使用 Kerberos 或针对 AD 的 LDAP 绑定并不重要，除非您的客户端/服务器无法缓存凭据（例如，使用会话），每个（后续）请求都必须重新进行身份验证，因为 HTTP 是一种无状态协议，与SSH。
尽管 Kerberos 会使主机和客户端上的配置变得更容易，只要 msysgit 的 HTTP 传输库支持使用 SSPI 或 GSSAPI 与 SPNEGO 进行协商。
我严重怀疑 Mercurial 能否解决该问题，因为它不执行任何身份验证。有些图书馆就是这样做的。
What is actually the problem? Supplying credentials manually all the time?
It does not matter if you use Kerberos or an LDAP bind against AD, unless your client/server is unable to cache the credentials (e.g. with a session) every (subsequent) request has to be reauthenticated because HTTP is a stateless protocol in contrast to SSH.
Though Kerberos would make this way easier in terms of configuration on the host and the client als long as the HTTP transport library of msysgit supports Negotiate with SPNEGO with SSPI or GSSAPI.
I seriously doubt that Mercurial would solve that problem because it does not perform any auth. Some library does for it.