Re: [Libvir] PATCH: 1/10: SASL authentication support

> Actually there we should looks for a password and store it, that's very > common and convenient, e.g. use > xen://foo:bar@server/ > > as the connection URI, libxml2 will just return the user as 'foo:bar' > which could subsequently be split here to store the password (bar). The virConnectCredentialPtr struct which is populated for the auth callback function contains a 'defresult' field where the default value of the credential should go. I intended to populate this value with the username part of the URI for VIR_CRED_AUTHNAME credentials, but forgot. Will add that in.... Using passwords in URIs is seriously frowned upon. URIs get into log files, in the command line ARGV, into gconf, into bug reports. We absolutely do not want passwords visible in any of those places. RFC 2396 explicitly recommends against using passwords in URIs "Some URL schemes use the format "user:password" in the userinfo field. This practice is NOT RECOMMENDED, because the passing of authentication information in clear text (such as URI) has proven to be a security risk in almost every case where it has been used."