Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have multiple subversion repositories which are served up through Apache 2.2 and WebDAV. They are all located in a central place, and I used this debian-administration.org article as the basis (I dropped the use of the database authentication for a simple htpasswd file though).

Since then, I have also started using WebSVN. My issue is that not all users on the system should be able to access the different repositories, and the default setup of WebSVN is to allow anyone who can authenticate.

According to the WebSVN documentation, the best way around this is to use subversion's path access system, so I looked to create this, using the AuthzSVNAccessFile directive.

When I do this though, I keep getting "403 Forbidden" messages.

My files look like the following:

I have default policy settings in a file:

<Location /svn/>
  DAV svn
  SVNParentPath  /var/lib/svn/repository

  Order deny,allow
  Deny from all
</Location>

Each repository gets a policy file like below:

<Location /svn/sysadmin/>
    Include  /var/lib/svn/conf/default_auth.conf
    AuthName "Repository for sysadmin"
    require user joebloggs jimsmith mickmurphy
</Location>

The default_auth.conf file contains this:

SVNParentPath      /var/lib/svn/repository
AuthType           basic
AuthUserFile       /var/lib/svn/conf/.dav_svn.passwd
AuthzSVNAccessFile /var/lib/svn/conf/svnaccess.conf

I am not fully sure why I need the second SVNParentPath in default_auth.conf, but I just added that today as I was getting error messages as a result of adding the AuthzSVNAccessFile directive.

With a totally permissive access file

[/]
joebloggs = rw

the system worked fine (and was essentially unchanged), but as I soon as I start trying to add any kind of restrictions such as

[sysadmin:/]
joebloggs = rw

instead, I get the 'Permission denied' errors again. The log file entries are:

[Thu May 28 10:40:17 2009] [error] [client 89.100.219.180] Access denied: 'joebloggs' GET websvn:/
[Thu May 28 10:40:20 2009] [error] [client 89.100.219.180] Access denied: 'joebloggs' GET svn:/sysadmin

What do I need to do to get this to work? Have configured apache wrong, or is my understanding of the svnaccess.conf file incorrect?

If I am going about this the wrong way, I have no particular attachment to my overall approach, so feel free to offer alternatives as well.

UPDATE (20090528-1600):

I attempted to implement this answer, but I still cannot get it to work properly.

I know most of the configuration is correct, as I have added

[/]
joebloggs = rw

at the start and 'joebloggs' then has all the correct access.

When I try to go repository-specific though, doing something like

[/]
joebloggs = rw

[sysadmin:/]
mickmurphy = rw

then I got a permission denied error for mickmurphy (joebloggs still works), with an error similar to what I already had previously

[Thu May 28 10:40:20 2009] [error] [client 89.100.219.180] Access denied: 'mickmurphy' GET svn:/sysadmin

Also, I forgot to explain previously that all my repositories are underneath

/var/lib/svn/repository

UPDATE (20090529-1245):

Still no luck getting this to work, but all the signs seem to be pointing to the issue being with path-access control in subversion not working properly. My assumption is that I have not conf

share|improve this question
    
At which relative server url does your websvn run? In my current setup websvn is at /websvn, whereas the repository itself is at /svn –  Sander Rijken Jun 2 '09 at 22:10
    
hi kaybenleroll can you help me on this? stackoverflow.com/questions/13541629/… –  juned Nov 26 '12 at 11:10
add comment

4 Answers 4

up vote 4 down vote accepted

The issue is probably relating to the splitting of configuration between two location directives, but I'm not sure.

Rather than defining permissions in two places (apache config and the authz file), just define them in the authz file. Like so:

httpd.conf

<Location /svn>
  DAV svn
  SVNParentPath /var/lib/svn/repository

  Require valid-user
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /path/to/.htpasswd

  SVNPathAuthz on
  AuthzSVNAccessFile /path/to/svn.authz
</Location>

svn.authz

[groups]
sysadmins = joebloggs jimsmith mickmurphy

# By default, nobody has any permissions
[/]
* = 

# sysadmins get access to the sysadmin repository
[sysadmin:/]
@sysadmins = rw

You would need the appropriate users in the htpasswd file too, obviously.

share|improve this answer
    
can you help me on this ? stackoverflow.com/questions/13541629/… –  juned Nov 26 '12 at 11:11
add comment

Have no idea whether or not you have solved this issue, but this is the procedure that works for me.

Forget fiddling with apache directives, instead edit WebSVN's config.php file and include/uncomment the following directive:

$config->useAuthenticationFile('/path/to/your/authz/file');

share|improve this answer
    
No, never fully solved it. I'll try your idea. :) –  kaybenleroll Mar 23 '10 at 20:29
    
+1 I had the same problem and this completely fixed it! Thanks! –  John Virgolino Jan 22 '11 at 22:06
add comment

this works for me.

user1 can see "/" and "/project1" user3 can see only "/project1"

[groups]

groupa = user1, user2

groupb = user3, user4

[/]

@groupa = rw

[/project1]

@groupb = rw

share|improve this answer
add comment

I have struggled with this quite a lot, and the only configuration that works for me is the following:

Authz file
------
[groups]
group1=user1
group2=user2

#Read and write for everyone defined in some group, others denied
[/]
@group1=rw
@group2=rw
*=

[project1:/]
@group1=rw
*=

[project2:/]
@group2=r
*=
----end authz file

As a result, group1 has read and write access to project1, and group2 has read access to project2. Everyone else does not have access to any projects.

I should emphasize, that "project1" and "project2" are projects inside the repository defined in Apache configuration file subversion.conf as.

Subversion.conf
----
LoadModule dav_module         modules/mod_dav.so
LoadModule dav_svn_module     modules/mod_dav_svn.so
LoadModule authz_svn_module   modules/mod_authz_svn.so

<Location /svn>
   DAV svn
   SVNParentPath /var/www/svn
   AuthType Basic
   AuthName "Name of the root repositories"
   Require valid-user
</Location>

<Location /svn/repos>
   AuthName "Subversion subrepository"
   AuthUserFile /var/www/svn/repos/conf/passwdfile
#Authz control
   AuthzSVNAccessFile /var/www/svn/repos/conf/authz
</Location>

-----end

My current problem is, that it is not possible to list the projects at repository /svn/repos at all (although they can be properly accessed). SVNListParentPath on directive, regardless where you put it, it does not help.

Currently my /var/www/svn is not a repository, but just a directory in a servers filesystem. /var/www/svn/repos is a repository created with svnadmin create

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.