15

I want to convince my boss that we should be using git for version control. He says, that it absolutely must authenticate users through our central LDAP server.

I looked at the various solutions (gitweb, gitorious ... ) and couldn't really find a definitive answer about whether they support LDAP authentication.

The only solution I could find a little info on was a Apache+mod_ldap setting. But that would mean that the user authenticating on LDAP wouldn't necessarily be the same as the actual git user, right? (Not that this is a huge problem, but just something which would bug me.)

So, what's the best way to authenticate git users via LDAP?

1
  • 1
    I added some more info on http auth.
    – reconbot
    Apr 22, 2010 at 18:05

2 Answers 2

8

While keys are used for most public git services, the real authentication happens via ssh. SSH is more then capable of authenticating against ldap. As far as git is concerned once you have access to the files you can go to town.

UPDATE

Git now supports (as of this year, who knew?) a smart http pushing mechanism. The old way was to use a webdav server, but both fetching and pushing were very slow and inefficient. Now you can get pretty much the same speeds over http as you would ssh:// or git://. This means you can use apache or nginx and use any http auth scheme you would like. (Ldap, database, etc.)

More info from pro git and github.

3
  • 1
    If SSH is configured to use PAM for authentication you can auth against your LDAP server without a problem. The notable exception is Gitosis, which does some forced-commands magic with keys.
    – voretaq7
    Apr 16, 2010 at 15:06
  • Alas, ssh is not capable without still-not-merged patches of getting public keys from LDAP. It'll do password auth via LDAP using pam-ldap, but it can't query LDAP directly to get public keys. Very frustrating. Dec 5, 2012 at 6:09
  • You can script this, a daily load of keys from ldap to the filesystem combined with a way to kick it off with however you update keys could do the trick.
    – reconbot
    Jan 18, 2013 at 20:36
2

You can look for/develop an git backend authentication using pre-receive git hooks scripts. They are not necessarily needed to be an shell script.

For example, if you look into gitorious' pre-receive hook, you'll see its way to authenticate the guy who are trying to push into the remote repo in that situation using a Ruby Script. If you wish and spend a bit of your time on it, you can do the same using your favorite language and its ldap library :-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .