Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got an existing SVN system that we're migrating away from SVN AuthUserFile (a flat file format) to LDAP authentication. In so doing, we'd like to establish a transitional phase where both LDAP and AuthUserFile work.

Does Apache support fall through authentication mechanisms? I'm reading the documentation and it's still not clear either way.

share|improve this question
up vote 6 down vote accepted

Apache 2.2 introduces a more flexible auth scheme that allows for multiple providers. The linked example contains the line:

AuthBasicProvider file ldap

By naming more than one source (file and ldap), you've defined multiple authentication sources and their order. Easy!

share|improve this answer
Sorry for the self-reply; I should have googled harder. – jldugger Mar 17 '10 at 22:45
You beat me to it. We do this exact thing, we have AD integrated LDAP lookups, along with a few special-case users for off-site contractors who need SVN access, but we don't want to add into the AD. – Mark Henderson Mar 17 '10 at 22:46
self replies are perfectly OK, it even says so in the FAQ :) – Mark Henderson Mar 17 '10 at 22:46

In modperl, there is a phase called PerlAuthenHandler. This phase is of type RUN_FIRST, meaning that if the first authenticaton handler found fails, it will check the next authentication in the chain. If it succeeds, it will run the next Apache phase.

I believeyou can set this without using modperl and just by using the Apache configuration tags. So you can try setting your authentication to LDAP first, and then your SVN AuthFile. It will try to authenticate first to LDAP and if it fails, it will try to authenticate to the SVN Authfile.

Hope this helped.

share|improve this answer

Assuming this is a PAM supported Unix system, you can try using mod_pam, mod_auth_external or any other PAM module for PAM based authentication.

Using PAM should let you chain fall through authentications.

Disclaimer: Haven't tried this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.