Re: git clone fails "with error: RPC failed; result=22, HTTP code = 401

On Fri, Jul 06, 2012 at 02:04:10PM +0200, Ilya Ruprecht wrote:

        <Location "/git/repo1.git">
                # read access
                <Limit GET>
                        require ldap-group repo.writers
                        require ldap-group repo.readers
                </Limit>

                # write access
                <Limit GET PUT POST DELETE PROPPATCH MKCOL COPY MOVE
LOCK UNLOCK>
                        require ldap-group repo.writers
                </Limit>

As you noticed, this will not do what you want. Git's smart-http
protocol uses POST requests to send the list of heads during ref
negotiation. So even a fetch request will require both GETs and POSTs.

The right way to restrict reading versus writing over smart-http is to
check which git service is being requested (confusingly, "git-upload-pack"
is for clones and fetches, and "git-receive-pack" is for pushes; the
names are based on what the _server_ is doing). There is an example in
the git-http-backend documentation, which uses a LocationMatch along
with a "require" directive.

-Peff