Re: REMOTE_USER value propagation through http push

[axel.ml@laposte.net]

Message du 13/04/11 13:00
> De : "Jakub Narebski" 
> A : "Axel" 
> Copie à : git@vger.kernel.org
> Objet : Re: REMOTE_USER value propagation through http push
>
> 
> Axel  writes:
> 
> > I set up a git server with HTTP authentication with Apache through
> > LDAP (Debian Squeeze + Apache 2.2 + mod_authnz_ldap).
> > 
> > I m using gitweb for browsing the repositories. At this moment, the
> > commiter name appears to be the local user who called "git push". The
> > username used for HTTP authentication is not used as commiter name,
> > though the REMOTE_USER environment variable is defined.
> > 
> > After a quick look at http-backend.c it looks like the
> > GIT_COMMITER_NAME variable should have been defined with the
> > REMOTE_USER variable. Is this right ?
> > 
> > In Apache access logs, the REMOTE_USER appears to be defined in the
> > last request of the push :
> > 
> > 127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] "GET
> > /git/sandbox/info/refs?service=git-receive-pack HTTP/1.1" 200 467 "-"
> > "git/1.7.2.5"
> > 127.0.1.1 - - [13/Apr/2011:11:45:08 +0200] "POST
> > /git/sandbox/git-receive-pack HTTP/1.1" 401 618 "-" "git/1.7.2.5"
> > 127.0.1.1 - ldapuser [13/Apr/2011:11:45:08 +0200] "POST
> > /git/sandbox/git-receive-pack HTTP/1.1" 200 353 "-" "git/1.7.2.5"
> > 
> > Is this behaviour expected ?
> 
> I don't quite understand.
> 
> With push over _any_ transport you transfer commits from your
> repository to remote repository *without changing them*. Committer is
> a person who created a commit, i.e. did "git commit" (or "git am", or
> "git rebase", or "git merge").
> 
> The only place where user who did "git push" can appear in is _reflogs_
> (I don't know if it appears or not)... but gitweb doesn't show wny
> reflog information. That of course can be improved...
> 

Indeed I wrongly used the "commit" word. I m switching from SVN/WebDAV, and the HTTP authentication name is usually used as the commiter name in the SVN repository. This name was informative only but useful when browsing repository and logs.

I would have enjoy to reproduce this behavior with git/http, since it s common (in our organisation at least) that the commiter is the pusher. In fact until today the authentication was almost only used as tracing commiters in logs and not really for security considerations.

So I assume that it s cannot be done for the moment :)
Thanks for your answer !

Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ?
Je crée ma boîte mail www.laposte.net