proxy: support authenticated proxies

[ajstarks]

Note that this issue is probably related to #310, some environments have all outside Internet access mediated by an NTLM authenticated proxy. Athens should support this use-case

[timraymond]

I did a little research here since I had never heard of NTLM before :) The exchange that needs to happen between go, the proxy, and the outside world needs to look like this in an NTLM-authenticated world:

I pulled the above from MSDN, and there's quite a bit of detail there.

One challenge here will be setting up a minimum-viable NTLM proxy + Active Directory-equivalent to develop against. I found this project which may be able to help with the proxy part. @ajstarks are you aware of any other alternatives which might help with developing this?

The other challenge is going to be getting go to do this exchange. One possible idea would be to shim go's upstream connection with a local http proxy (via the http_proxy ENV?) that performs this exchange with the bastion proxy.

[ajstarks]

Yes, I know about cntlm but I have never used it. By the way, curl lets you do this:

curl --proxy [host:port] --proxy-ntlm -U[user:password]

The ideal case is for Athena to support this internally without other tools, of course

[arschles]

@ajstarks did you figure out a way around this?

[ajstarks]

Sorry, no.

[arschles]

Just dropping a quick note in here - we haven't forgotten about this issue, but not planning to implement it at the moment. @ajstarks or anyone else interested - can you please 👍 this comment, or add your own comment if you need this functionality for your production Athens deployments?

[ajstarks]

I currently don't need this now, so I'm ok with lowering the priority.

[arschles]

@ajstarks I am going to close this, since you don't need it now. If it comes back up, comment here and I'll get the notification and come open the issue back up.

[arschles]

just going to throw this in here: https://github.com/genotrance/px

This could potentially be a good way for Athens to download from VCS's via HTTP, and from upstream proxyes (which already use HTTP as we know)