Is there a way to authorize user via ldap on a git repository? Or phrased slightly differently: Is there a way to deny people pull/push if they are not in a specific ldap group?

Edit: Yes, great idea using PAM and/or a hook. Does anyone have experience using git in combination with pam_ldap?

share|improve this question

Should work:

  • Access git repos over SSH using standard logins (nothing unusual here).

  • Make your git repos have access permissions for a certain group, which particular logins have membership of.

  • Use pam-ldap to make your standard login system work with LDAP.

If there's a more specific way, that JUST checks ldap without affecting the rest of your system? I don't know, but it's probably possible with a pre-commit hook, or something like that.

share|improve this answer
1  
a pre-commit hook is run client side – Steve Buzonas Aug 10 '12 at 1:44

You can use update or pre-receive hook to do additional access control; see update-paranoid (in Perl) from contrib/hooks/ for an example (it doesn't uses LDAP, but you can always modify it to use it, using for example DBI via DBD::LDAP to store permission configuration, or Authen::Simple::LDAP directly).

It might be possible to enhance tools such like gitosis (in Python) or gitolite, which are used to access git repositories via SSH without requiring to set up (perhaps limited) separate shell account for each user, to use LDAP for authentication.

share|improve this answer

The straightforward solution I've experienced is the following:

  1. Setup CentrifyDC Express to provide you pam-ldap;
  2. Access your GIT repositories via SSH.

Et voilà!

share|improve this answer
1  
Or additionally, you could setup PAM-based HTTP/S access to your GIT repos. – rdarrudas Nov 26 '13 at 7:15

You may want to look into Gitorious with Craig Andrews LDAP plugin.

Gitorious is a well respected (open source) solution for corporate environments providing web and SSH access to repositories.

Craig's additions to the code base make LDAP a source for authorization and authentication.

https://gitorious.org

https://gitorious.org/gitorious/mainline/merge_requests/138 <-- merge in LDAP support

Hopefully the code will be merged into the mainline of Gitorious soon so we wont have to patch it ourselves.

share|improve this answer

A possible solution is to use git over smart-http. If you use this protocol you can set up your Apache server to authenticate through LDAP, and then have your git transferring data over http.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.