Configure GIT server over HTTP using LDAP

Question

I am quite new to GIT and overall am not very experienced in infrastructure setup. However, what I am trying to do seems to be very basic and I am not able to do it.

I am trying to create a GIT server exposed through HTTPS in Apache. I have the following configuration of my GIT repository (on CentOS system):

SetEnv GIT_PROJECT_ROOT /opt/repo-git/my-custom-repo.git
SetEnv GIT_HTTP_EXPORT_ALL
ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/
SetEnv REMOTE_USER=$REDIRECT_REMOTE_USER

<Directory "/opt/repo-git/my-custom-repo.git">
  Options -Indexes FollowSymLinks
  AllowOverride AuthConfig FileInfo
  Order allow,deny
  Allow from all
</Directory>

<Directory "/usr/libexec/git-core">
  AllowOverride None
  Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
  Order allow,deny
  Allow from all
</Directory>

<Location /git>
  Order deny,allow
  Allow from all
  Dav on
  AuthType Basic
  AuthzLDAPAuthoritative on
  AuthName "Trac"
  Require valid-user
  AuthBasicProvider ldap
  AuthLDAPURL "ldap://my-ldap-configuration-that-works"
  AuthLDAPBindDN "my-ldap-dn"
  AuthLDAPBindPassword "my-password"
</Location>

With this configuration I am able to checkout code using git clone https://<my-ip>/git. However I am not able to push I get the following error in TortoiseGit:

Counting objects: 3, done.
Writing objects: 100% (3/3), 207 bytes | 0 bytes/s, done.
Total 3 (delta 0), reused 0 (delta 0)
remote: error: insufficient permission for adding an object to repository database ./objects
remote: fatal: failed to write object
error: unpack failed: unpack-objects abnormal exit
To https://<my-ip>/git
! [remote rejected] master -> master (unpacker error)
error: failed to push some refs to 'https://<my-ip>/git'

Such error is reported in here, here, here and many more places.

None of these sources are helpful to me - they practically propose the same thing. What I can't get is what group and owner should I set for the repository. I am currently setting apache which is the user that runs the Apache server. However I have the suspicion that the GIT magic in the Apache configuratoin uses some other user for my commit (e.g. my LDAP user). This makes no sense, however, am I to change file permissions on every server of mine everytime when change in the LDAP appears?

Is there any special default git user to be used in such configuration?

I confirm that the apache user and group have full control on my GIT repository.

Answer 1

I was able to get Git configuration to work for me.

My target configuration was to setup GIT for repository, GERRIT over it for code reviews and integrate all these with my company's LDAP.

You can see that it took me almost 3 weeks to get it all running, but now I finally got it all final.

GERRIT was the most important milestone - it turns out it provides the functionality I needed itself - it provides http interface for the repository and then uses one system account to do actual actions on the repository.

GERRIT also integrates beautifully with LDAP allowing you do configure ldap groups for project access permissions and use LDAP users for repository interactions.

The only small thing is that one needs to use GERRIT generated password with his LDAP user to access the repositories. However, this is not a huge drawback, becasue you log into the GERRIT UI using your full LDAP credentials and then are able to generate this password for yourself, meaning that you have full control over it.