Allowed to 5 auth requests before fail (https://github.com/composer/composer/blob/6687743adbac1fe73ca81912a6ef29ceb6e5cc2f/src/Composer/Util/Svn.php#L115).

src/Composer/Util/Svn.php

@@ -20,6 +20,8 @@ use Composer\IO\IOInterface;
  */
 class Svn
 {
+    const MAX_QTY_AUTH_TRIES = 5;
+
     /**
      * @var array
      */
@@ -50,6 +52,11 @@ class Svn
      */
     protected $process;
 
+    /**
+     * @var integer
+     */
+    protected $qtyAuthTries = 0;
+
     /**
      * @param string                   $url
      * @param \Composer\IO\IOInterface $io
@@ -112,11 +119,8 @@ class Svn
             );
         }
 
-        // TODO keep a count of user auth attempts and ask 5 times before
-        // failing hard (currently it fails hard directly if the URL has credentials)
-
-        // try to authenticate
-        if (!$this->hasAuth()) {
+        // try to authenticate if maximum quantity of tries not reached
+        if ($this->qtyAuthTries++ < self::MAX_QTY_AUTH_TRIES || !$this->hasAuth()) {
             $this->doAuthDance();
 
             // restart the process