mirror of
https://github.com/git/git
synced 2024-08-24 10:15:51 +00:00
Merge branch 'jk/doc-http-backend'
Improve documentation to illustrate "push authenticated, fetch anonymous" configuration for smart HTTP servers. * jk/doc-http-backend: doc/http-backend: match query-string in apache half-auth example doc/http-backend: give some lighttpd config examples doc/http-backend: clarify "half-auth" repo configuration
This commit is contained in:
commit
c6c4d61673
|
@ -80,7 +80,30 @@ ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/
|
|||
----------------------------------------------------------------
|
||||
+
|
||||
To enable anonymous read access but authenticated write access,
|
||||
require authorization with a LocationMatch directive:
|
||||
require authorization for both the initial ref advertisement (which we
|
||||
detect as a push via the service parameter in the query string), and the
|
||||
receive-pack invocation itself:
|
||||
+
|
||||
----------------------------------------------------------------
|
||||
RewriteCond %{QUERY_STRING} service=git-receive-pack [OR]
|
||||
RewriteCond %{REQUEST_URI} /git-receive-pack$
|
||||
RewriteRule ^/git/ - [E=AUTHREQUIRED:yes]
|
||||
|
||||
<LocationMatch "^/git/">
|
||||
Order Deny,Allow
|
||||
Deny from env=AUTHREQUIRED
|
||||
|
||||
AuthType Basic
|
||||
AuthName "Git Access"
|
||||
Require group committers
|
||||
Satisfy Any
|
||||
...
|
||||
</LocationMatch>
|
||||
----------------------------------------------------------------
|
||||
+
|
||||
If you do not have `mod_rewrite` available to match against the query
|
||||
string, it is sufficient to just protect `git-receive-pack` itself,
|
||||
like:
|
||||
+
|
||||
----------------------------------------------------------------
|
||||
<LocationMatch "^/git/.*/git-receive-pack$">
|
||||
|
@ -91,6 +114,15 @@ require authorization with a LocationMatch directive:
|
|||
</LocationMatch>
|
||||
----------------------------------------------------------------
|
||||
+
|
||||
In this mode, the server will not request authentication until the
|
||||
client actually starts the object negotiation phase of the push, rather
|
||||
than during the initial contact. For this reason, you must also enable
|
||||
the `http.receivepack` config option in any repositories that should
|
||||
accept a push. The default behavior, if `http.receivepack` is not set,
|
||||
is to reject any pushes by unauthenticated users; the initial request
|
||||
will therefore report `403 Forbidden` to the client, without even giving
|
||||
an opportunity for authentication.
|
||||
+
|
||||
To require authentication for both reads and writes, use a Location
|
||||
directive around the repository, or one of its parent directories:
|
||||
+
|
||||
|
@ -158,6 +190,54 @@ ScriptAliasMatch \
|
|||
ScriptAlias /git/ /var/www/cgi-bin/gitweb.cgi/
|
||||
----------------------------------------------------------------
|
||||
|
||||
Lighttpd::
|
||||
Ensure that `mod_cgi`, `mod_alias, `mod_auth`, `mod_setenv` are
|
||||
loaded, then set `GIT_PROJECT_ROOT` appropriately and redirect
|
||||
all requests to the CGI:
|
||||
+
|
||||
----------------------------------------------------------------
|
||||
alias.url += ( "/git" => "/usr/lib/git-core/git-http-backend" )
|
||||
$HTTP["url"] =~ "^/git" {
|
||||
cgi.assign = ("" => "")
|
||||
setenv.add-environment = (
|
||||
"GIT_PROJECT_ROOT" => "/var/www/git",
|
||||
"GIT_HTTP_EXPORT_ALL" => ""
|
||||
)
|
||||
}
|
||||
----------------------------------------------------------------
|
||||
+
|
||||
To enable anonymous read access but authenticated write access:
|
||||
+
|
||||
----------------------------------------------------------------
|
||||
$HTTP["querystring"] =~ "service=git-receive-pack" {
|
||||
include "git-auth.conf"
|
||||
}
|
||||
$HTTP["url"] =~ "^/git/.*/git-receive-pack$" {
|
||||
include "git-auth.conf"
|
||||
}
|
||||
----------------------------------------------------------------
|
||||
+
|
||||
where `git-auth.conf` looks something like:
|
||||
+
|
||||
----------------------------------------------------------------
|
||||
auth.require = (
|
||||
"/" => (
|
||||
"method" => "basic",
|
||||
"realm" => "Git Access",
|
||||
"require" => "valid-user"
|
||||
)
|
||||
)
|
||||
# ...and set up auth.backend here
|
||||
----------------------------------------------------------------
|
||||
+
|
||||
To require authentication for both reads and writes:
|
||||
+
|
||||
----------------------------------------------------------------
|
||||
$HTTP["url"] =~ "^/git/private" {
|
||||
include "git-auth.conf"
|
||||
}
|
||||
----------------------------------------------------------------
|
||||
|
||||
|
||||
ENVIRONMENT
|
||||
-----------
|
||||
|
|
|
@ -40,6 +40,9 @@ ErrorLog error.log
|
|||
<IfModule !mod_authz_user.c>
|
||||
LoadModule authz_user_module modules/mod_authz_user.so
|
||||
</IfModule>
|
||||
<IfModule !mod_authz_host.c>
|
||||
LoadModule authz_host_module modules/mod_authz_host.so
|
||||
</IfModule>
|
||||
</IfVersion>
|
||||
|
||||
PassEnv GIT_VALGRIND
|
||||
|
@ -115,6 +118,21 @@ SSLEngine On
|
|||
Require valid-user
|
||||
</LocationMatch>
|
||||
|
||||
RewriteCond %{QUERY_STRING} service=git-receive-pack [OR]
|
||||
RewriteCond %{REQUEST_URI} /git-receive-pack$
|
||||
RewriteRule ^/half-auth-complete/ - [E=AUTHREQUIRED:yes]
|
||||
|
||||
<Location /half-auth-complete/>
|
||||
Order Deny,Allow
|
||||
Deny from env=AUTHREQUIRED
|
||||
|
||||
AuthType Basic
|
||||
AuthName "Git Access"
|
||||
AuthUserFile passwd
|
||||
Require valid-user
|
||||
Satisfy Any
|
||||
</Location>
|
||||
|
||||
<IfDefine DAV>
|
||||
LoadModule dav_module modules/mod_dav.so
|
||||
LoadModule dav_fs_module modules/mod_dav_fs.so
|
||||
|
|
|
@ -294,5 +294,35 @@ test_expect_success 'push to auth-only-for-push repo' '
|
|||
test_cmp expect actual
|
||||
'
|
||||
|
||||
test_expect_success 'create repo without http.receivepack set' '
|
||||
cd "$ROOT_PATH" &&
|
||||
git init half-auth &&
|
||||
(
|
||||
cd half-auth &&
|
||||
test_commit one
|
||||
) &&
|
||||
git clone --bare half-auth "$HTTPD_DOCUMENT_ROOT_PATH/half-auth.git"
|
||||
'
|
||||
|
||||
test_expect_success 'clone via half-auth-complete does not need password' '
|
||||
cd "$ROOT_PATH" &&
|
||||
set_askpass wrong &&
|
||||
git clone "$HTTPD_URL"/half-auth-complete/smart/half-auth.git \
|
||||
half-auth-clone &&
|
||||
expect_askpass none
|
||||
'
|
||||
|
||||
test_expect_success 'push into half-auth-complete requires password' '
|
||||
cd "$ROOT_PATH/half-auth-clone" &&
|
||||
echo two >expect &&
|
||||
test_commit two &&
|
||||
set_askpass user@host &&
|
||||
git push "$HTTPD_URL/half-auth-complete/smart/half-auth.git" &&
|
||||
git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/half-auth.git" \
|
||||
log -1 --format=%s >actual &&
|
||||
expect_askpass both user@host &&
|
||||
test_cmp expect actual
|
||||
'
|
||||
|
||||
stop_httpd
|
||||
test_done
|
||||
|
|
Loading…
Reference in a new issue