0302ae86b8
* feat(ssh): support Kerberos/GSSAPI hosts via the system OpenSSH transport ssh2 has no gssapi-with-mic support, and adding it would mean forking its protocol layer plus packaging the kerberos native module for three platforms. Instead, route GSSAPI hosts through the existing system-OpenSSH transport, which delegates Kerberos (tickets, SSPI on Windows) to the platform ssh binary. Two tiers, because RHEL-family distros enable GSSAPIAuthentication globally in /etc/ssh/ssh_config and ssh -G therefore reports it for every host: - Targets whose ~/.ssh/config Host block explicitly sets GSSAPIAuthentication yes (imported as target.gssapiAuthentication) try system ssh first, falling through to ssh2 so key auth and credential prompts still work when no ticket is available. - When ssh2 exhausts key/agent auth and the ssh -G-resolved config enables GSSAPI, retry over system ssh before prompting for credentials, so Kerberos-only hosts on distro-default configs connect without a password prompt. Hosts where keys work never leave the ssh2 path. Manual targets flagged for GSSAPI pass -o GSSAPIAuthentication=yes explicitly since they bypass ssh_config. Both tiers work headless (no credential callbacks required). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ssh): harden GSSAPI transport selection (review fixes for PR #7507) Review fixes on top of the Kerberos/GSSAPI feature branch (s546126/kerberos-ssh): - HIGH: reset useSystemSshTransport on the ssh2 fall-through. doSystemSshProbe sets the flag before spawnSystemSshCommand, which throws synchronously when no system ssh binary is on PATH (outside the probe try/catch). The proactive fall-through previously reset only 2 of 3 transport fields, so exec/sftp kept routing through the failed transport - breaking GSSAPI on Windows-with-Git-ssh and headless Linux. - MEDIUM: throw a cancellation error (not the stale ssh2 authError) when a disconnect supersedes the reactive probe mid-flight, and guard connect()'s catch on disposed, so a deliberate disconnect is not overwritten with auth-failed. - MEDIUM: skip the encrypted-key passphrase prompt when the GSSAPI fallback applies, so a Kerberos ticket is tried before prompting; the general prompt still fires if the probe fails. Adds 3 mutation-verified regression tests and hardens two existing tests to assert the probe actually ran. Not connected to any PR remote. Co-authored-by: Orca <help@stably.ai> * fix(ssh): isolate GSSAPI system transport Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: s546126 <268420947+s546126@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>
2.1 KiB
Kerberos / GSSAPI SSH Authentication
Orca's ssh2-based SSH stack cannot speak gssapi-with-mic — the ssh2 library
has no GSSAPI userauth support, and adding it would mean forking ssh2's
protocol layer plus shipping the kerberos native module (MIT krb5 / Heimdal /
Windows SSPI) as a prebuilt Electron dependency on three platforms. Instead,
hosts that need Kerberos ride the existing system OpenSSH transport — the
same parallel transport already used for ProxyCommand/ProxyJump hosts —
which delegates GSSAPI, ticket lookup (kinit cache, Windows domain logon),
and credential delegation to the platform's own ssh binary on macOS, Linux,
and Windows (Win32-OpenSSH uses SSPI).
Transport selection
Two tiers, deliberately asymmetric because RHEL-family distros ship
GSSAPIAuthentication yes in the global /etc/ssh/ssh_config, which makes
ssh -G report GSSAPI enabled for every host:
- Proactive — a target with
gssapiAuthentication: true(parsed from an explicitGSSAPIAuthentication yesin the host's~/.ssh/configblock, or set on the target directly) tries the system-ssh probe first. If that fails (e.g. no ticket), the connect falls through to the normal ssh2 key/agent path where passphrase/password prompts remain available — OpenSSH semantics allow other auth methods alongside GSSAPI. - Auth-failure fallback — when ssh2 exhausts key/agent auth and the
ssh -G-resolved config enables GSSAPI (isGssapiSystemSshFallbackCandidateinssh-connection-utils.ts), the connection retries over system ssh before prompting the user for credentials. Kerberos-only hosts on distro-default configs connect this way; hosts where keys work never leave the ssh2 path.
Manual (non-ssh-config) targets flagged for GSSAPI get an explicit
-o GSSAPIAuthentication=yes in system-ssh-args.ts; config-backed targets
inherit the option from their own Host block since the system binary re-reads
ssh_config.
Both tiers work headless (orca serve): the system-ssh probe needs no
credential callbacks, and GSSAPI itself is non-interactive once a ticket
exists.