2

I've got an existing SVN system that we're migrating away from SVN AuthUserFile (a flat file format) to LDAP authentication. In so doing, we'd like to establish a transitional phase where both LDAP and AuthUserFile work.

Does Apache support fall through authentication mechanisms? I'm reading the documentation and it's still not clear either way.

3 Answers 3

6

Apache 2.2 introduces a more flexible auth scheme that allows for multiple providers. The linked example contains the line:

AuthBasicProvider file ldap

By naming more than one source (file and ldap), you've defined multiple authentication sources and their order. Easy!

3
  • Sorry for the self-reply; I should have googled harder.
    – jldugger
    Mar 17, 2010 at 22:45
  • 1
    You beat me to it. We do this exact thing, we have AD integrated LDAP lookups, along with a few special-case users for off-site contractors who need SVN access, but we don't want to add into the AD. Mar 17, 2010 at 22:46
  • self replies are perfectly OK, it even says so in the FAQ :) Mar 17, 2010 at 22:46
0

In modperl, there is a phase called PerlAuthenHandler. This phase is of type RUN_FIRST, meaning that if the first authenticaton handler found fails, it will check the next authentication in the chain. If it succeeds, it will run the next Apache phase.

I believeyou can set this without using modperl and just by using the Apache configuration tags. So you can try setting your authentication to LDAP first, and then your SVN AuthFile. It will try to authenticate first to LDAP and if it fails, it will try to authenticate to the SVN Authfile.

Hope this helped.

0

Assuming this is a PAM supported Unix system, you can try using mod_pam, mod_auth_external or any other PAM module for PAM based authentication.

Using PAM should let you chain fall through authentications.

Disclaimer: Haven't tried this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .