Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just set up an SVN server (on a Windows XP machine) for my lab at my university. Right now, anyone can access and commit to the repository anonymously.

I want to allow only certain users on our AD domain to be allowed to access the repository. If possible, I also want the passwords to be the same as the password for the domain.

Is this possible to do?

SOLVED

I installed mod_auth_sspi and configured my httpd.conf with the following:

DAV svn SVNPath "R:\SVN"

AuthName "SVN Server"
AuthType SSPI
SSPIAuth On
SSPIAuthoritative On
SSPIDomain AD
SSPIOfferBasic On
Require valid-user

AuthzSVNAccessFile "r:/svn/svnaccess.conf"

and in svnaccess.conf:

[groups]
dev = AD\user1, user1, AD\user2, user2

[/]
@dev = rw
share|improve this question
    
+1 - great question. I did this the LDAP way a few years ago and was a real hassle finding all the right info. I'm glad ServerFault exists for these kinds of questions now! –  Mark Henderson Feb 26 '10 at 2:23

3 Answers 3

up vote 6 down vote accepted

If you are using Apache, yes. Make sure that mod_auth_sspi is installed. You then configure the directory with the appropriate settings:

<Directory />
    Options FollowSymLinks
    AllowOverride None

    AuthType SSPI
    AuthName "YOURDOMAIN"
    SSPIAuth On
    SSPIAuthoritative Off
    SSPIDomain dc.yourdomain.com
    SSPIOmitDomain Off
    SSPIOfferBasic On
    SSPIUsernameCase lower
    Require group "YOURDOMAIN\AuthorizedGroup" 
</Directory>

In your svnpasswd file you simply specify the users with full domain names

developers = mydomain\myuser
[/]
@developers = rw

I hope that helps a bit.

share|improve this answer
    
I had to change a few settings but this worked for me! –  rlbond Mar 1 '10 at 18:02

You didn't explicitly state how Subversion is served, but based on your tags, I'm assuming Apache. Using Apache 2.2 to serve Subversion with authentication by AD is pretty simple.

In your Apache config, you need to add the appropriate Auth parameters to the location block for the repository.

For example (restricted read and write access):

<Location /repo>
    DAV svn
    SVNPath /var/svn/repo
    AuthName "Subversion WebDAV"
    AuthType Basic
    AuthLDAPURL "<ldap_url>"
    AuthLDAPBindDN "<ldap_bind_dn>"
    AuthLDAPBindPassword "<password>"
    Require valid-user
</Location>

You may need to talk to you AD administrator to set up a service account for Apache to use to connect to AD (if your AD requires you to bind before performing a search).

If you wish to allow anonymous reads while requiring users to authenticate to write, replace the Require valid-user line above with the following:

<LimitExcept GET PROPFIND OPTIONS REPORT>
    Require valid-user
</LimitExcept>
share|improve this answer
    
In case someone else comes along here in the future and finds this, a bit more info: Your AuthLDAPURL should look like: ldap://<domaincontroller>.<domain>.<local>:389/DC=<domain>,DC=<local>?sAMAccoun‌​tName?sub?(objectClass=*) (this example uses domain.local as your AD domain name, substitute where nessesary) –  Mark Henderson Feb 26 '10 at 2:22

Two other options for hosting subversion repositories on Windows are SVNIsapi and Visual SVN.

SVNIsapi is an IIS plugin for IIS 6.0 and above. AD security is provided by IIS.

Visual SVN bundles apache, svn and a GUI tool to administer repositories. AD security is provided by an apache module, and is configured via the GUI tool.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.