Re: git clone fails "with error: RPC failed; result=22, HTTP code = 401

From: Jeff King <peff@peff.net>
Date: Jul 10, 2012, 20:51 UTC
Message-ID: <20120710205128.GD23798@sigill.intra.peff.net>
In-Reply-To: <CAEpEX_7xrGR+Uk5601iKKPr0uQDkT2sQ4ziPVmqCASYy51hBCQ@mail.gmail.com>

On Fri, Jul 06, 2012 at 02:04:10PM +0200, Ilya Ruprecht wrote:

Show 12 quoted lines

>         <Location "/git/repo1.git">
>                 # read access
>                 <Limit GET>
>                         require ldap-group repo.writers
>                         require ldap-group repo.readers
>                 </Limit>
> 
>                 # write access
>                 <Limit GET PUT POST DELETE PROPPATCH MKCOL COPY MOVE
> LOCK UNLOCK>
>                         require ldap-group repo.writers
>                 </Limit>

As you noticed, this will not do what you want. Git's smart-http protocol uses POST requests to send the list of heads during ref negotiation. So even a fetch request will require both GETs and POSTs.

The right way to restrict reading versus writing over smart-http is to check which git service is being requested (confusingly, "git-upload-pack" is for clones and fetches, and "git-receive-pack" is for pushes; the names are based on what the _server_ is doing). There is an example in the git-http-backend documentation, which uses a LocationMatch along with a "require" directive.

-Peff