Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am configuring a subversion repository to use basic LDAP authentication. I have an entry in my http.conf file that looks like this:

<Location /company/some/location>
DAV svn
SVNPath /repository/some/location
AuthType Basic
AuthName LDAP
AuthBasicProvider ldap
Require valid-user
AuthLDAPBindDN "cn=SubversionAdmin,ou=admins,o=company.com"
AuthLDAPBindPassword "XXXXXXX"
AuthLDAPURL "ldap://company.com/ou=people,o=company.com?personid"
</Location>

This works fine for living, breathing people who need to log in. However, I also need to provide application accounts access to the repository. These accounts are in a different OU. Do I need to add a whole new <location> element, or can I add a second AuthLDAPURLto the existing entry?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

You can use mod_authn_alias to create aliases for your providers. There was an example in this question for pretty much exactly the same use case:

<AuthnProviderAlias ldap alpha>
  AuthLDAPBindDN "CN=Subversion,OU=Service Accounts,O=Alpha"
  AuthLDAPBindPassword [[REDACTED]]
  AuthLDAPURL ldap://dc01.alpha:3268/?sAMAccountName?sub?
</AuthnProviderAlias>

<AuthnProviderAlias ldap beta>
  AuthLDAPBindDN "CN=LDAPAuth,OU=Service Accounts,O=Beta"
  AuthLDAPBindPassword [[REDACTED]]
  AuthLDAPURL ldap://ldap.beta:3268/?sAMAccountName?sub?
</AuthnProviderAlias>

# Subversion Repository
<Location /svn>
  DAV svn
  SVNPath /opt/svn/repo
  AuthName "Subversion"
  AuthType Basic
  AuthBasicProvider alpha beta
  AuthzLDAPAuthoritative off
  AuthzSVNAccessFile /opt/svn/authz
  require valid-user
</Location>
share|improve this answer
    
I want to provide a repo at /svn which is only available to staff, and then allow customers to access their individual subdirectories like /svn/customerA? We have only one repo. Will this work for that? –  Stefan Lasiewski May 14 '10 at 18:53
    
@Stefan: Yes, you can do that. Just use the authz file to limit read/write access. –  Kamil Kisiel May 15 '10 at 5:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.