Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Quick background. We are running Subversion Server 1.6.5 (No Apache just the SVN server) on a Windows box with no web access. We only use TortoiseSVN and AnkhSVN and for continuous integration we use the svn client command line.

OK, so I've looked around on the NET and read the SVN book a bit and I don't understand why this user setup does not work.

authz (SVN authorization file) contents:

    ### Sanitized version
    devUsers = user1
    qaUsers = user2

    @devUsers = r
    @qaUsers = r

    @devUsers = rw
    ~devUsers = 

    ### QA Projects
    @qaUsers = rw
    ~qaUsers =

From what I've read, you have to grant all users at a minimum read access to the root of your repository. OK, fine. That works. Next up my /Dev/SourceCode directory should only be accessible to @devUsers, but for some reason in TortoiseSVN's repo-browser, @qaUsers can see this folder. I'm guessing the global read access on / is overriding the ~devUsers = line in the authz file? And same goes for the /Dev/TestCases folder that should only be accessible to @qaUsers, yet @devUsers can view this folder too. That's one of my problems.

The main problem though is that /Dev/SourceCode's subfolders are only read-only. I know this because when I attempt to check in something into a subfolder it says authorization failed. However, in the root folder, if you check in a file, it works fine.

I'm guessing this is the / read-only access overriding things again. Does this mean that each subfolder has to be given explicit rw permissions? Is there anyway to say from this point on use the current parent folder's permissions?, i.e. /Dev/SourceCode's permissions . This seems really inconvenient if you want to grant rw permissions to to all subfolders when there are many subfolders.

share|improve this question
up vote 0 down vote accepted

My initial thought when I saw your authorization file was, "aren't the repository names missing from the path declarations?"

By this I mean,

@devUsers = rw
@qaUsers = 

should look like,

@devUsers = rw
@qaUsers = 

or, if `Dev' is the name of the repository,

@devUsers = rw
@qaUsers = 

I use apache for our repositories, but the syntax looks the same whether it's httpd or svnserve: Path-Based Authorization

I hope this helps.

Thank you,

share|improve this answer
It didn't work at first. I was using Dev for the repo-name because that's what it appeared to be in Windows Explorer. Then I tried dev and all good. Thanks man. – nickytonline Aug 6 '10 at 17:05

The cascading of permissions should work as you expect; there's no need for permissions on every dir. You only need to specify the more specific paths to override the permissions from the parent, as you are doing.

I'm not familiar with the ~groupname syntax. You're clearly intending it to mean negation (users not in the group) but I'm not sure it's supported. Try something like this (your first two sections for group defs and root access the same):

@devUsers = rw
@qaUsers = 

@qaUsers = rw
@devUsers =

This should work, although denying your developers access to the test cases makes me sad.

EDIT: Since you've tried this, and it doesn't work ... maybe try reversing the order? The matching is supposed to happen on most-specific to least-specific, so the order shouldn't matter, but I would at least try putting these earlier in the file than the [/] permissions. If that makes a difference, then I would suspect a bug in your server version.

share|improve this answer
The config I posted isn't my real breakdown, so don't worry, devs can see test cases ;) . Also what you posted doesn't work. I tried this before and ended up with the same result. @devUsers could see what they're not supposed to. As well, the cascading of permissions does not appear to work. Well it does, but the cascade appears to work from the root so people get read-only access for every folder except the folders I deem rw. – nickytonline Jul 27 '10 at 13:01

Totally separate idea(s) from my other answer:

... you sure there isn't a typo (e.g. case) in your [/Dev/testCases] definition? (You're on Windows: I know that Windows will display things as 'Dev' if they are actually named 'DEV', for example ... but SVN will probably care)

... also, you sure it isn't supposed to be [/trunk/Dev/testCases] or something?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.