{"thread":{"id":"27083","subject":"REMOTE_USER value propagation through http push","startedAt":"2011-04-13T09:48:51Z","lastAt":"2011-04-13T16:32:11Z","messageCount":8,"participants":["Axel","Jakub Narebski","axel.ml@laposte.net"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"165732","messageId":"4DA57183.6040308@laposte.net","threadId":"27083","inReplyTo":null,"subject":"REMOTE_USER value propagation through http push","fromName":"Axel","fromEmail":"axel.ml@laposte.net","sentAt":"2011-04-13T09:48:51Z","receivedAt":"2011-04-13T09:48:51Z","isPatch":false,"sender":{"key":"axel.ml@laposte.net","avatar":null},"body":"Hello\n\nI set up a git server with HTTP authentication with Apache through LDAP \n(Debian Squeeze + Apache 2.2 + mod_authnz_ldap).\n\nI m using gitweb for browsing the repositories. At this moment, the \ncommiter name appears to be the local user who called \"git push\". The \nusername used for HTTP authentication is not used as commiter name, \nthough the REMOTE_USER environment variable is defined.\n\nAfter a quick look at http-backend.c it looks like the GIT_COMMITER_NAME \nvariable should have been defined with the REMOTE_USER variable. Is this \nright ?\n\nIn Apache access logs, the REMOTE_USER appears to be defined in the last \nrequest of the push :\n\n127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] \"GET \n/git/sandbox/info/refs?service=git-receive-pack HTTP/1.1\" 200 467 \"-\" \n\"git/1.7.2.5\"\n127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] \"POST \n/git/sandbox/git-receive-pack HTTP/1.1\" 401 618 \"-\" \"git/1.7.2.5\"\n127.0.1.1 - ldapuser [13/Apr/2011:11:45:08 +0200] \"POST \n/git/sandbox/git-receive-pack HTTP/1.1\" 200 353 \"-\" \"git/1.7.2.5\"\n\nIs this behaviour expected ?\n\nThanks\n"},{"id":"165735","messageId":"m3sjtm2z8e.fsf@localhost.localdomain","threadId":"27083","inReplyTo":"4DA57183.6040308@laposte.net","subject":"Re: REMOTE_USER value propagation through http push","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2011-04-13T11:00:37Z","receivedAt":"2011-04-13T11:00:37Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Axel <axel.ml@laposte.net> writes:\n\n> I set up a git server with HTTP authentication with Apache through\n> LDAP (Debian Squeeze + Apache 2.2 + mod_authnz_ldap).\n> \n> I m using gitweb for browsing the repositories. At this moment, the\n> commiter name appears to be the local user who called \"git push\". The\n> username used for HTTP authentication is not used as commiter name,\n> though the REMOTE_USER environment variable is defined.\n> \n> After a quick look at http-backend.c it looks like the\n> GIT_COMMITER_NAME variable should have been defined with the\n> REMOTE_USER variable. Is this right ?\n> \n> In Apache access logs, the REMOTE_USER appears to be defined in the\n> last request of the push :\n> \n> 127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] \"GET\n> /git/sandbox/info/refs?service=git-receive-pack HTTP/1.1\" 200 467 \"-\"\n> \"git/1.7.2.5\"\n> 127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] \"POST\n> /git/sandbox/git-receive-pack HTTP/1.1\" 401 618 \"-\" \"git/1.7.2.5\"\n> 127.0.1.1 - ldapuser [13/Apr/2011:11:45:08 +0200] \"POST\n> /git/sandbox/git-receive-pack HTTP/1.1\" 200 353 \"-\" \"git/1.7.2.5\"\n> \n> Is this behaviour expected ?\n\nI don't quite understand.\n\nWith push over _any_ transport you transfer commits from your\nrepository to remote repository *without changing them*.  Committer is\na person who created a commit, i.e. did \"git commit\" (or \"git am\", or\n\"git rebase\", or \"git merge\").\n\nThe only place where user who did \"git push\" can appear in is _reflogs_\n(I don't know if it appears or not)... but gitweb doesn't show wny\nreflog information.  That of course can be improved...\n\n-- \nJakub Narebski\nPoland\nShadeHawk on #git\n"},{"id":"165737","messageId":"5222475.65704.1302693678918.JavaMail.www@wwinf8226","threadId":"27083","inReplyTo":"m3sjtm2z8e.fsf@localhost.localdomain","subject":"Re: REMOTE_USER value propagation through http push","fromName":"","fromEmail":"axel.ml@laposte.net","sentAt":"2011-04-13T11:21:18Z","receivedAt":"2011-04-13T11:21:18Z","isPatch":false,"sender":{"key":"axel.ml@laposte.net","avatar":null},"body":"\nMessage du 13/04/11 13:00\n> De : \"Jakub Narebski\" \n> A : \"Axel\" \n> Copie à : git@vger.kernel.org\n> Objet : Re: REMOTE_USER value propagation through http push\n>\n> \n> Axel  writes:\n> \n> > I set up a git server with HTTP authentication with Apache through\n> > LDAP (Debian Squeeze + Apache 2.2 + mod_authnz_ldap).\n> > \n> > I m using gitweb for browsing the repositories. At this moment, the\n> > commiter name appears to be the local user who called \"git push\". The\n> > username used for HTTP authentication is not used as commiter name,\n> > though the REMOTE_USER environment variable is defined.\n> > \n> > After a quick look at http-backend.c it looks like the\n> > GIT_COMMITER_NAME variable should have been defined with the\n> > REMOTE_USER variable. Is this right ?\n> > \n> > In Apache access logs, the REMOTE_USER appears to be defined in the\n> > last request of the push :\n> > \n> > 127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] \"GET\n> > /git/sandbox/info/refs?service=git-receive-pack HTTP/1.1\" 200 467 \"-\"\n> > \"git/1.7.2.5\"\n> > 127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] \"POST\n> > /git/sandbox/git-receive-pack HTTP/1.1\" 401 618 \"-\" \"git/1.7.2.5\"\n> > 127.0.1.1 - ldapuser [13/Apr/2011:11:45:08 +0200] \"POST\n> > /git/sandbox/git-receive-pack HTTP/1.1\" 200 353 \"-\" \"git/1.7.2.5\"\n> > \n> > Is this behaviour expected ?\n> \n> I don't quite understand.\n> \n> With push over _any_ transport you transfer commits from your\n> repository to remote repository *without changing them*. Committer is\n> a person who created a commit, i.e. did \"git commit\" (or \"git am\", or\n> \"git rebase\", or \"git merge\").\n> \n> The only place where user who did \"git push\" can appear in is _reflogs_\n> (I don't know if it appears or not)... but gitweb doesn't show wny\n> reflog information. That of course can be improved...\n> \n\nIndeed I wrongly used the \"commit\" word. I m switching from SVN/WebDAV, and the HTTP authentication name is usually used as the commiter name in the SVN repository. This name was informative only but useful when browsing repository and logs.\n\nI would have enjoy to reproduce this behavior with git/http, since it s common (in our organisation at least) that the commiter is the pusher. In fact until today the authentication was almost only used as tracing commiters in logs and not really for security considerations.\n\nSo I assume that it s cannot be done for the moment :)\nThanks for your answer !\n\nUne messagerie gratuite, garantie à vie et des services en plus, ça vous tente ?\nJe crée ma boîte mail www.laposte.net\n"},{"id":"165744","messageId":"m3oc4a2tzf.fsf@localhost.localdomain","threadId":"27083","inReplyTo":"5222475.65704.1302693678918.JavaMail.www@wwinf8226","subject":"Re: REMOTE_USER value propagation through http push","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2011-04-13T12:53:53Z","receivedAt":"2011-04-13T12:53:53Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"axel.ml@laposte.net writes:\n> Jakub Narebski wrote:\n> > Axel  writes:\n> > \n> > > I set up a git server with HTTP authentication with Apache through\n> > > LDAP (Debian Squeeze + Apache 2.2 + mod_authnz_ldap).\n> > > \n> > > I m using gitweb for browsing the repositories. At this moment, the\n> > > commiter name appears to be the local user who called \"git push\".\n\nThe comitter name is local user who created a commit (as specified in\nhis/her configuration file, fallback to GECOS).\n\n> > > The username used for HTTP authentication is not used as\n> > > commiter name, though the REMOTE_USER environment variable is\n> > > defined.\n> > > \n> > > After a quick look at http-backend.c it looks like the\n> > > GIT_COMMITER_NAME variable should have been defined with the\n> > > REMOTE_USER variable. Is this right ?\n\nNo, it isn't.\n\n> > > In Apache access logs, the REMOTE_USER appears to be defined in the\n> > > last request of the push :\n> > > \n> > > 127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] \"GET\n> > > /git/sandbox/info/refs?service=git-receive-pack HTTP/1.1\" 200 467 \"-\"\n> > > \"git/1.7.2.5\"\n> > > 127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] \"POST\n> > > /git/sandbox/git-receive-pack HTTP/1.1\" 401 618 \"-\" \"git/1.7.2.5\"\n> > > 127.0.1.1 - ldapuser [13/Apr/2011:11:45:08 +0200] \"POST\n> > > /git/sandbox/git-receive-pack HTTP/1.1\" 200 353 \"-\" \"git/1.7.2.5\"\n> > > \n> > > Is this behaviour expected ?\n> > \n> > I don't quite understand.\n> > \n> > With push over _any_ transport you transfer commits from your\n> > repository to remote repository *without changing them*. Committer is\n> > a person who created a commit, i.e. did \"git commit\" (or \"git am\", or\n> > \"git rebase\", or \"git merge\").\n> > \n> > The only place where user who did \"git push\" can appear in is _reflogs_\n> > (I don't know if it appears or not)... but gitweb doesn't show wny\n> > reflog information. That of course can be improved...\n> > \n> \n> Indeed I wrongly used the \"commit\" word. I'm switching from\n> SVN/WebDAV, and the HTTP authentication name is usually used as the\n> commiter name in the SVN repository. This name was informative only\n> but useful when browsing repository and logs.\n\nThis is because Subversion is CENTRALIZED version control system:\ncreating a commit involves contacting central server that holds\nrepository.  If you use HTTP(S) to contact this central server, then\nof course HTTP authentication name will be used for \"committer\" name\n(IIRC Subversion has only _author_ name, not separate author and\ncommitter names like in Git[1]).\n\nGit on the other hand is DISTRIBUTED version control system.  Here the\nact of creating a commit is decoupled from the act of publishing[2].\nUser creates commit in his/her local clone (copy) of repository, using\ntheir local configuration, and then push to some distribution point\n(depending on workflow).\n\nFor git-aware push transports (ssh, \"smart\" http, IIRC also file) you\ncan configure git via hook mechanism to check comitter and reject\npushes if there are commits that were not made by the person who is\ndoing the push.  See e.g. update-paranoid in contrib/hooks/ area of\ngit.git repository, Gitosis and Gitolite git repository management\nsolutions.\n\n\n[1] Author is usually the same as committer -- it can be different\n    if for example you are applying (with \"git am\") patch from somebody\n    else you got e.g. via email.\n\n[2] Credentials used for authentication when pushing doesn't need to\n    have anything in comon with configured user identity.\n\n> \n> I would have enjoy to reproduce this behavior with git/http, since\n> it's common (in our organisation at least) that the commiter is the\n> pusher. In fact until today the authentication was almost only used\n> as tracing commiters in logs and not really for security\n> considerations.\n> \n> So I assume that it s cannot be done for the moment :)\n> Thanks for your answer !\n\nCould you explain in more detail _what_ behavior would you like to\nsee?  Gitweb does display author and comitter (though in 'log' and\n'shortlog' only author is visible).\n\n-- \nJakub Narebski\nPoland\nShadeHawk on #git\n"},{"id":"165751","messageId":"22124707.170284.1302701972329.JavaMail.www@wwinf8403","threadId":"27083","inReplyTo":"m3oc4a2tzf.fsf@localhost.localdomain","subject":"Re: REMOTE_USER value propagation through http push","fromName":"","fromEmail":"axel.ml@laposte.net","sentAt":"2011-04-13T13:39:32Z","receivedAt":"2011-04-13T13:39:32Z","isPatch":false,"sender":{"key":"axel.ml@laposte.net","avatar":null},"body":"\n> Could you explain in more detail _what_ behavior would you like to\n> see? Gitweb does display author and comitter (though in 'log' and\n> 'shortlog' only author is visible).\n> \n\nI understand well your explanations about git mechanisms.\n\nThough git is decentralized, we still use a \"central\" repository on which gitweb is installed, mainly for pratical reasons (you may tell \"then you don't need git!\" :) ) because not only developers browse the commits history.\nAt this moment we use HTTP authentication more for tracing purposes (knowing who pushed data to the repo) than for allowing or not push access.\n\nIf i m not wrong, the AUTHOR field displayed in gitweb comes from the git client configuration ($GIT_AUTHOR_NAME).\n\nI would go further : HTTP authentication (for in-house organisation of course, not internet-wide access) usefulness is unclear since the credentials do not pop up anywhere in git repository. We have to trust the client-side configuration. The way to know who pushed something is to browse Apache access.log and cross the date/time with the git log.\n\nWhat I d like to see is that the push authentication credentials overwrite an eventually defined author name at the client side in order to be displayed while browsing git log.\n\nEven better, in the case of LDAP authentication (I m not sure if it would be possible for htaccess authentication), email and fullname could be extracted from LDAP directory, stored in environment variables by Apache, and given to git-http-backend (as is the REMOTE_USER variable).\n\nThough I dont know if this request is relevant, I guess that if git-http-backend was looking for GIT_AUTHOR_NAME & GIT_AUTHOR_EMAIL environment variables that Apache could have defined, it could replace the client-side values defined. (Note that I absolutly don't know if it would be technically possible to overwrite those variables or even if their values are in the push payload).\n\n\nUne messagerie gratuite, garantie à vie et des services en plus, ça vous tente ?\nJe crée ma boîte mail www.laposte.net\n"},{"id":"165753","messageId":"201104131627.29138.jnareb@gmail.com","threadId":"27083","inReplyTo":"22124707.170284.1302701972329.JavaMail.www@wwinf8403","subject":"Re: REMOTE_USER value propagation through http push","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2011-04-13T14:27:27Z","receivedAt":"2011-04-13T14:27:27Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"On Wed, 13 Apr 2011, Axel wrote:\n> \n> > Could you explain in more detail _what_ behavior would you like to\n> > see? Gitweb does display author and comitter (though in 'log' and\n> > 'shortlog' only author is visible).\n> > \n> \n> I understand well your explanations about git mechanisms.\n> \n> Though git is decentralized, we still use a \"central\" repository on\n> which gitweb is installed, mainly for pratical reasons (you may tell\n> \"then you don't need git!\" :) ) because not only developers browse the\n> commits history.\n\nThat is quite common in many workflows to have one \"central\" \nby-convention repository where everybody can view history and get \nlatest version of a project.\n\nNote however that there are other possible workflows than SVN-like\none where everybody publish to single \"central\" repository.  Quite \ncommon at least for open source project is workflow where one person \n(maintainer) is responsible for getting contributions from other \ndevelopers (via pull, via email, etc.) and pushing them to this \n\"central\" repository.\n\nI recommend reading chapters \"Distributed Git\" (for description of \npossible workflows) and \"Git on the Server\" (among others describing \nconfiguring access and logging) of free CC-BY-NC-SA  \"Pro Git\" book:\n\n  http://progit.org/book/\n\n> At this moment we use HTTP authentication more for tracing purposes\n> (knowing who pushed data to the repo) than for allowing or not push\n> access.  \n\nI'm not sure if it is a best solution.  HTTP authentication is decoupled \nfrom git itself.  I don't know if you are using older \"dumb\" HTTP \ntransport, or new \"smart\" HTTP transport (the latter requires git to be \ninstalled on server), but any git-aware transport can log updates to \nrepository via hooks mechanism.\n\nSee for example \"better logging\" issue in Gitolite FAQ:\n\nhttp://sitaramc.github.com/gitolite/doc/3-faq-tips-etc.html#_better_logging\n\nGitolite is one of tools to manage git repositories.\n \n> If i m not wrong, the AUTHOR field displayed in gitweb comes from the\n> git client configuration ($GIT_AUTHOR_NAME). \n\nYes it does, though actually modern way is to put\n\n  [user]\n  \tname  = Joe R. Hacker\n  \temail = J.Hacker@example.com\n\nin $HOME/.gitconfigure file for user (client).\n \n> I would go further : HTTP authentication (for in-house organisation\n> of course, not internet-wide access) usefulness is unclear since the\n> credentials do not pop up anywhere in git repository. We have to trust\n> the client-side configuration. The way to know who pushed something is\n> to browse Apache access.log and cross the date/time with the git log.    \n> \n> What I'd like to see is that the push authentication credentials\n> overwrite an eventually defined author name at the client side in\n> order to be displayed while browsing git log.  \n\nThis is not possible, and I don't see that it would be changed.  \nChanging credentials would require (because of SHA-1 based addressing) \nchanging commits.  Note that one is usually pushing more than one \ncommit at once with push.\n \nWhat you can do is the REVERSE.  Check on push if committer info matches \nauthentication credentials used for publishing, and refuse push if it \nis not true.  But that requires git-aware transport; I think Gitolite\ncan be configured to do that, and that update-paranoid hook example also\ncan do this.\n\n> Even better, in the case of LDAP authentication (I m not sure if it\n> would be possible for htaccess authentication), email and fullname\n> could be extracted from LDAP directory, stored in environment\n> variables by Apache, and given to git-http-backend (as is the\n> REMOTE_USER variable).    \n\nBecause commits are created on client side, in client repository, you \ncannot trust committer and author stored in git commits.\n\nIf user.name is not set, and neither are GIT_AUTHOR_NAME / \nGIT_COMMITTER_NAME environmental variables, git tries to take name from \nlogin information.  I think operating system can be configured to take \nit from LDAP, but git itself doesn't do this -- but it could.\n \n> Though I don't know if this request is relevant, I guess that if\n> git-http-backend was looking for GIT_AUTHOR_NAME & GIT_AUTHOR_EMAIL\n> environment variables that Apache could have defined, it could replace\n> the client-side values defined. (Note that I absolutly don't know if\n> it would be technically possible to overwrite those variables or even\n> if their values are in the push payload).     \n\nNope, at the time of push commits are already created, and author and \ncommitter info are already set in stone, and not possible to change \nwithout rewriting commits.\n \nHTH\n-- \nJakub Narebski\nPoland\n"},{"id":"165754","messageId":"12538384.27708.1302706703346.JavaMail.www@wwinf8204","threadId":"27083","inReplyTo":"201104131627.29138.jnareb@gmail.com","subject":"Re: REMOTE_USER value propagation through http push","fromName":"","fromEmail":"axel.ml@laposte.net","sentAt":"2011-04-13T14:58:23Z","receivedAt":"2011-04-13T14:58:23Z","isPatch":false,"sender":{"key":"axel.ml@laposte.net","avatar":null},"body":"\n> Message du 13/04/11 16:29\n> De : \"Jakub Narebski\" \n> A : \"Axel\" \n> Copie à : git@vger.kernel.org\n> Objet : Re: REMOTE_USER value propagation through http push\n>\n> \n> Nope, at the time of push commits are already created, and author and \n> committer info are already set in stone, and not possible to change \n> without rewriting commits.\n>\n\nI will dive further into the links you gave. I think I'll sacrify the credentials information then for the moment.\nIs there a chance that we ll see one day this third level of information (the authentication credentials) added to the push and displayed by gitweb ?\n\nI thank you for your long answers.\n\n\nUne messagerie gratuite, garantie à vie et des services en plus, ça vous tente ?\nJe crée ma boîte mail www.laposte.net\n"},{"id":"165758","messageId":"m3k4ey2jvn.fsf@localhost.localdomain","threadId":"27083","inReplyTo":"12538384.27708.1302706703346.JavaMail.www@wwinf8204","subject":"Re: REMOTE_USER value propagation through http push","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2011-04-13T16:32:11Z","receivedAt":"2011-04-13T16:32:11Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Axel <axel.ml@laposte.net> writes:\n\n> Jakub Narebski wrote:\n> > \n> > Nope, at the time of push commits are already created, and author and \n> > committer info are already set in stone, and not possible to change \n> > without rewriting commits.\n> \n> I will dive further into the links you gave. I think I'll sacrify\n> the credentials information then for the moment.\n\nWhat you can do in _distributed_ version control system such as git is\nto ensure that pushed *existing* commits (created on client) match\ncredentials.\n\nThat is opposed to situation in _centralized_ version control system\nwhere credentials are used to *create* commits on server.\n\n> Is there a chance that we ll see one day this third level of\n> information (the authentication credentials) added to the push and\n> displayed by gitweb ?\n\nWell, git by itself doesn't log authentication credentials.  In the\nreflog you have user which git is running as, and only if push was\ndone via smart protocol (and core.logAllRefUpdates is true on server).\n\nSo it is unlikely for gitweb to display e.g. gitolite logs... well,\nunless gitolite would adds it to gitweb via some pluggable mechanism\nlike $feature{'actions'}.\n\n-- \nJakub Narebski\nPoland\nShadeHawk on #git\n"}]}