8

My company has a bunch of git repos in a folder which has access control through our active directory domain. So far the folder has been accessed via smb using kerberos authentication and all of our clients are set up with file:// urls.

This is obviously very bad. I'm trying to get us set up with a proper git server either over http or over ssh but our network administrator is very clear that whatever solution we pursue has to maintain the active directory group based permissions (with preference to maintaining file level permissions), and that the company isn't willing to pay for a solution. Unfortunately these requirements tie my hands a bit and keep me from using my previously tried and true nginx git bundle.

I've done some research, but I'm really having a hard time putting the pieces together. Does anyone know of (or can point me in the right direction of) a solution which accomplishes:

  • Serving git via a standard protocol (http/https/ssh preferred) instead of file protocol
  • Authenticating all users against active directory
  • Free (open source preferred)
  • Runs on Windows (our network administrator is not comfortable with unix).
  • Ideally will accept kerberos tickets to allow single sign on.
  • Ideally will authenticate users against the folder permissions of the repository instead of separate group based permission configuration (network administrator doesn't want any more work maintaining this).

[Edit: added forgotten requirement regarding OS]

[Edit over a year later]

I am leaving this question here because it got some upvotes, so apparently there are other people who have had similar needs. Any and all answers which partially meet this list might be helpful to future readers. My own problems have been solved by us getting a new System Administrator who isn't afraid of linux freeing me to leverage many more options.

[/Edit]

Improve this question
3
  • Possibly this don't merits an answer of its own, but Apache can host Git repositories with the proper extensions enabled. It also has modules for using Windows authentication, and so far everything is free and open source, capable of both http and https. I've not done it myself, but look here for details: jeremyskinner.co.uk/2010/07/31/…
    – Alejandro
    Commented Jun 6, 2015 at 17:36
  • Have you proposed the alternative of eliminating all direct file access to the git repo files? This has a few advantages: 1) It reduces your requirement to, "must integrate with active directory for users" and 2) it forces everyone off the direct file access. People are unlikely to switch from something they believe works fine unless forced to, and you seem to be the only one who cares enough to change it. 3) The network admin doesn't have to maintain funky folder permissions for a bunch of repos anymore. If everyone is willing, you could even take repo permissions off his hands entirely.
    – jpmc26
    Commented Feb 1, 2016 at 17:21
  • 1
    Up until the end there - "My own problems have been solved by us getting a new System Administrator who isn't afraid of linux freeing me to leverage many more options" - I was gonna suggest just having your server guy take a linux course or get lpi cert.
    – ivanivan
    Commented Jan 11, 2018 at 2:55

2 Answers 2

Reset to default
0

I recommend RhodeCode Enterprise (https://rhodecode.com) which fulfills all but not the folder permission requirement. RhodeCode Enterprise 3 is free for up to 10 users and EDUs and additionally supports Mercurial and SVN.

Disclaimer: I am a RhodeCode co-founder.

Improve this answer
2
  • FYI the site does not mention anywhere accessibility of various authentication mechanisms. Additionally, the site mentions windows compatibility, but then I get to download and windows compatiblity is in beta. For those reasons, I am not liking the idea of pursuing this. Can you provide some documentation about how I would be setting this up (note that currently our repository is on a Windows server)
    – lassombra
    Commented Apr 7, 2015 at 0:41
  • Please contact us on the website, mentioning this thread, to get beta access to our Windows Installer for RhodeCode Enterprise 3.
    – Sebastian
    Commented Apr 7, 2015 at 7:25
0

First, your SA needs to understand the central repo is like a database, so file ownerships are and should be irrelevant. The AD should only be used for authentication to access the data, in fact it is best the data is managed by a daemon who has the sole access to the headless repo at that central location. That's how it's done by all systems such as gitlab, github, stash, etc. In fact, you can install stash or gitlab (which a long list of benefits other than security) and allow users to be authenticated by AD, either via an LDAP gateway or directly. Atlassian Stash and Gitlab are freemium options (I think), there are also GitHub Enterprise and others, plus a few FOSS options as well (though I don't know about their AD integration options)

Improve this answer
1
  • I 100% agree with what you are saying, unfortunately, your answer depends on changing the SA's mind about things which I have neither the time with company nor the clout with the SA to do so. Gitlab was my first and preferred option, but my SA pushes back on that because of Gitlab's attitude towards windows (A very dumb reason to be sure, but you play the cards you are dealt). Also, I've been struggling enough just to get this company to pay a one time cost on some software (hardware is easy to get for some reason) and all the offerings other than Gitlab are a charge past 5 users.
    – lassombra
    Commented Jul 16, 2016 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.