Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a single SVN repo at /var/svn/ with a few subdirectories. Staff must be able to access the top-level directory and all subdirectories within it, but I want to restrict access to subdirectories using alternate htpasswd files.

This works for our Staff.

<Location />
DAV svn
SVNParentPath /var/svn

AuthType Basic
AuthBasicProvider ldap

# mod_authnz_ldap
AuthzLDAPAuthoritative off
AuthLDAPURL "ldap.example.org:636/ou=people,ou=Unit,ou=Host,o=ldapsvc,dc=example,dc=org?uid?sub?(objectClass=PosixAccount)"
AuthLDAPGroupAttribute memberUid
AuthLDAPGroupAttributeIsDN off

Require ldap-group cn=staff,ou=PosixGroup,ou=Unit,ou=Host,o=ldapsvc,dc=example,dc=org
</Location>

Now, I am trying to restrict access to a subdirectory with a separate htpasswd file, like this:

<Location /customerA>
DAV svn
SVNParentPath /var/svn

# mod_authn_file
AuthType Basic
AuthBasicProvider file
AuthUserFile /usr/local/etc/apache22/htpasswd.customerA
Require user customerA
</Location>

I can use Firefox and curl to browse to this folder fine:

curl https://svn.example.org/customerA/ --user customerA:password

But I cannot use check out this SVN repository:

$ svn co https://svn.example.org/customerA/
svn: Repository moved permanently to 'https://svn.example.org/customerA/'; please relocate

And on the server logs, I get this strange error:

# httpd-access.log
192.168.19.13 - - [03/May/2010:16:40:00 -0700] "OPTIONS /customerA HTTP/1.1" 401 401
192.168.19.13 - customerA [03/May/2010:16:40:00 -0700] "OPTIONS /customerA HTTP/1.1" 301 244

# httpd-error.log
[Mon May 03 16:40:00 2010] [error] [client 192.168.19.13] Could not fetch resource information.  [301, #0]
[Mon May 03 16:40:00 2010] [error] [client 192.168.19.13] Requests for a collection must have a trailing slash on the URI.  [301, #0]

My questions:

  1. Can I restrict access to Subversion subdirectories using Apache access controls? DocumentRoot is commented out, so it's not clear that the FAQ at http://subversion.apache.org/faq.html#http-301-error applies.
  2. I prefer to not use AuthzSVNAccessFile, because it doesn't support LDAP groups. We control access using LDAP, and make heavy use of LDAP groups.
share|improve this question
    
I earned the Tumbleweed badge for this! –  Stefan Lasiewski May 11 '10 at 20:08

1 Answer 1

I've just spent all afternoon trying to do it, and I think the answer to question 1 as you've asked it is "no". If I try it and look in the error log, I see errors on PROPFIND requests for paths like "/myrepo/!svn": i.e., I think the Subversion client is sometimes requesting magic paths that only have meaning to the Subversion server module, as opposed to paths like "/myrepo/subdir" that Apache could understand and restrict.

The fact that you're using SVNParentPath, however, makes me suspect that /var/svn actually contains multiple Subversion repositories, and customerA is one such repository. You can tell by checking if there is a file /var/svn/customerA/format.

Is that correct? If so, you can set up a VirtualHost or another location where you can access just the customerA repository using the SVNPath directive. For example:

<VirtualHost>
  ServerName customerA.example.com

  <Location />
     SVNPath /var/svn/customerA
     ...
  </Location>
</VirtualHost>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.