git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: git-http-backend: anonymous read, authenticated write

From
Jakub Narębski <jnareb@gmail.com>
Date
Apr 9, 2013, 12:24 UTC
Message-ID
<5164087A.3030007@gmail.com>
In-Reply-To
<20130409054553.GA1537@mteis.lan>
On 09.04.2013, Magnus Therning wrote:
Show 19 quoted lines
> I've been trying to set up git-http-backend+lighttpd.  I've managed to
> set up anonymous read-only access, and I then successfully configured
> authentication for both read and write.  Then I get stuck.  The
> man-page for git-http-backend says that the following snippet can be
> used for Apache 2.x:
> 
>     <LocationMatch "^/git/.*/git-receive-pack$">
>         AuthType Basic
>         AuthName "Git Access"
>         Require group committers
>         ...
>     </LocationMatch>
> 
> However, when I put in this match on location in my lighty config and
> try to push I'm not asked for a password, instead I'm greeted with
> 
>     % git push 
>     error: The requested URL returned error: 403 Forbidden while 
>      accessing
http://magnus@tracsrv.local/git/foo.git/info/refs?service=git-receive-pack
> 
> AFAICS this means the man-page is wrong, and that I instead ought to
> match on the "service=git-receive-pack" part.  Is that a correct
> conclusion?
Yes, it is.

I have tried to do the same anonymous read and authenticated write in "smart HTTP" access in Apache. There are some proposals[1], all I think which use mod_rewrite (as LocationMatch doesn't take query string into account, unfortunately), but I haven't been able to make it work.

The problem is that both POST *and GET* (to get refs) must be authethicated.
Nb. I thought that it was corrected... which git version do you use?
[1]: http://paperlined.org/apps/git/SmartHTTP_Ubuntu.html

In the end I have worked around this by allowing all registered users to read with "require valid-user" (which in my situation might be even more correct solution; the case being repositories for Computer Science class lab work), and restricting write via pre-receive hook which checks REMOTE_USER.

-- 
Jakub Narębski
Previous: Magnus TherningNext: Magnus Therning
Message 2 of 23 in “git-http-backend: anonymous read, authenticated write”
  1. Magnus TherningApr 9, 2013
  2. Jakub NarębskiApr 9, 2013
  3. Magnus TherningApr 10, 2013
  4. Jeff KingApr 9, 2013
  5. Magnus TherningApr 10, 2013
  6. Jeff KingApr 10, 2013
  7. Jakub NarębskiApr 10, 2013
  8. Jeff KingApr 10, 2013
  9. Magnus TherningApr 10, 2013
  10. Jeff KingApr 11, 2013
  11. 0/2 http-backend documentation examplesJeff King, Apr 11, 2013
  12. 1/2 doc/http-backend: clarify "half-auth" repo configurationJeff King, Apr 11, 2013
  13. Magnus TherningApr 11, 2013
  14. 2/2 doc/http-backend: give some lighttpd config examplesJeff King, Apr 11, 2013
  15. Jakub NarębskiApr 11, 2013
  16. Jeff KingApr 11, 2013
  17. Jakub NarębskiApr 11, 2013
  18. 3/2 doc/http-backend: match query-string in apache half-auth exampleJeff King, Apr 13, 2013
  19. Jakub NarębskiApr 13, 2013
  20. Magnus TherningApr 11, 2013
  21. Jeff KingApr 11, 2013
  22. Magnus TherningApr 12, 2013
  23. Jakub NarębskiApr 11, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.