1

How can we achieve fine grained ACL with smart http in gitolite?

What this exactly means is: If I restrict certain repos for some users in gitolite using ssh and if I try to clone the restricted repo, gitolite tells:

Fatal R any (some_username) is denied. 
Please make sure the repository exists".

How to achieve the above mentioned ACL by using smart http?
If possible please specify the setup(apache2) for achieving the same.

VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
Balaji Kumar
  • 11
  • 2

1 Answers1

0

gitolite is compatible with smart http, as I mentioned in 2012 or in here.

All you need to do is set those 4 lines:

SetEnv GIT_PROJECT_ROOT @H@/repositories
SetEnv GIT_HTTP_EXPORT_ALL
SetEnv GITOLITE_HTTP_HOME @H@
ScriptAlias /hgit/ /path/to/gitolite/sbin/gitolite-shell/
SetEnv GIT_HTTP_BACKEND "/path/to/git/libexec/git-core/git-http-backend"

That way, any url with a path starting with /hgit will query gitolite first (through its src/gitolite-shell perl script)

git clone http://myserver/hgit/myrepo.git

You need to couple that with a way to authenticate yourself through one of the authentication basic provider (file, ldap, dbm, ...)
In my httpd.conf, I use LDAP.

    AuthName "LDAP authentication for ITSVC Smart HTTP Git repositories"
    AuthType Basic
    AuthBasicProvider ldap
    AuthLDAPBindDN "@LDAP_BINDDN@"
    AuthLDAPBindPassword @LDAP_PASSWORD@
    AuthLDAPURL @LDAP_URL@
    AuthLDAPGroupAttribute member

You would replace the placeholder string @xxx@ by their actual values.

Community
  • 1
  • 1
VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • I tried with the above mentioned code. But still i couldn't find the answer. Can you please post the steps(code) in a sequential way such that i will get a clear understanding of which step to execute first and which one to do last. I read so many documents about "smart-http" implementation and it's actually very confusing and everybody implemented the same topic in multiple ways which seems very complicated for a starter like me. Please help me solve this issue. – Balaji Kumar Apr 21 '17 at 10:02