From: Jeff King <peff@peff.net>
Date: Tue, 10 Jul 2012 20:51:28 GMT
Subject: Re: git clone fails "with error: RPC failed; result=22, HTTP code = 401
Message-ID: <20120710205128.GD23798@sigill.intra.peff.net>
In-Reply-To: <CAEpEX_7xrGR+Uk5601iKKPr0uQDkT2sQ4ziPVmqCASYy51hBCQ@mail.gmail.com>

On Fri, Jul 06, 2012 at 02:04:10PM +0200, Ilya Ruprecht wrote:

>         <Location "/git/repo1.git">
>                 # read access
>                 <Limit GET>
>                         require ldap-group repo.writers
>                         require ldap-group repo.readers
>                 </Limit>
> 
>                 # write access
>                 <Limit GET PUT POST DELETE PROPPATCH MKCOL COPY MOVE
> LOCK UNLOCK>
>                         require ldap-group repo.writers
>                 </Limit>

As you noticed, this will not do what you want. Git's smart-http
protocol uses POST requests to send the list of heads during ref
negotiation. So even a fetch request will require both GETs and POSTs.

The right way to restrict reading versus writing over smart-http is to
check which git service is being requested (confusingly, "git-upload-pack"
is for clones and fetches, and "git-receive-pack" is for pushes; the
names are based on what the _server_ is doing). There is an example in
the git-http-backend documentation, which uses a LocationMatch along
with a "require" directive.

-Peff