On 04/03/2010 05:52 PM, D. Richard Hipp wrote: > Another (important) benefit of using the project code instead of > random salt is that the client already knows the project code, and > hence it does not need to do a preliminary round-trip to the server > just to get the salt prior to encoding the users password whenever it > does a push or pull.
D'oh--I forgot that the hash is sent over the wire for authentication as well. Nevermind--I withdraw my argument/request. > So if you want to add a user to multiple repositories, you can simply > write a script that inserts entries into the USER table of the various > repositories with a cleartext password. > > Or, if you are writing scripts, your script can invoke "fossil user > password LOGIN PASSWORD --repository REPOSITORY-FILENAME" which will > cause the password to be inserted hashed instead of cleartext. These don't really solve my problem, as I've only just created the latest project repo. I'll probably add another one or two later on. It would be really nice to be able to copy the users from one project to another in some cases (or have a delegated single source for authentication--maybe the CGI REMOTE_USER variable as someone mentioned recently), but I now agree that my suggestion wouldn't be a good way to achieve it. -- Joshua Paine LetterBlock LLC http://letterblock.com/ Web applications built with joy. _______________________________________________ fossil-users mailing list fossil-users@lists.fossil-scm.org http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
