Gerrit doesn't delete tag with right permissions

[GoogleCodeExporter]

Affected Version: v2.10.3.1

Steps to reproduce:
1. Create a git project
2. Set permissions as outlined in attachment
3. Create and push a lightweight tag with commands like
   git tag "1.f"
   git push --tags
4. Try to delete tag from local and remote repos:
   git tag -d 1.f (this is successful, obviously)
   git push origin :refs/tags/1.f   (this fails)

Intended outcome: the tag is deleted from the remote repository.

Real outcome:
It outputs this message:

remote: Branch refs/tags/1.f:
remote: You need 'Push' rights with the 'Force Push'
remote: flag set to delete references.
remote: User: okitain
remote: Please read the documentation and contact an administrator
remote: if you feel the configuration is incorrect
remote: Processing changes: refs: 1, done    
To ssh://okitain@my.server.path:29418/sandbox/tags

I have been unable to reproduce this issue with gerrit 2.11, however, the 
server setup was significantly different.

Original issue reported on code.google.com by okit...@gmail.com on 27 May 2015 at 8:42

Attachments:

• gerrit-wtf.png

[GoogleCodeExporter]

What the permissions on your "Public-Projects" parent project.
It may be that force push on tags is blocked in on of the parent projects.

Original comment by edwin.ke...@gmail.com on 27 May 2015 at 12:25

• Changed state: AwaitingInformation

[GoogleCodeExporter]

Here are important parts of configs to All-Projects (which everything inherits 
from) and Public-Projects (which this project inherits from). I don't see 
anything relevant yet.

Surely a block from pushing tags for anonymous users doesn't affect a 
registered, administrator user? 

Original comment by okit...@gmail.com on 27 May 2015 at 12:39

Attachments:

• All-Projects.png
• Public-Projects.png

[GoogleCodeExporter]

> Surely a block from pushing tags for anonymous users doesn't affect a 
registered,  > administrator user? 

It does. Blocking 'Anonymous Users', means blocking it for all users.

Original comment by edwin.ke...@gmail.com on 27 May 2015 at 12:43

[GoogleCodeExporter]

Thank you very much. It works, although for the life of me I can't grasp why 
the all-users group is named Anonymous Users.

Original comment by okit...@gmail.com on 27 May 2015 at 1:17

[GoogleCodeExporter]

> although for the life of me I can't grasp why the all-users group is named 
> Anonymous Users.

Yes, this is confusing. Maybe the name should be changed.

Original comment by edwin.ke...@gmail.com on 27 May 2015 at 1:22

• Changed state: Invalid