Setup: We have a machine (SRV1) serving Subversion via Apache to client machines running Windows 7 (CLI1), OS X (CLI2), and presumably some other clients running Windows XP (CLI3). While the material we are serving is not high security, the usernames and passwords used for access are used elsewhere, so we would like to keep the authentication portion encrypted.
SRV1: Not yet joined to our domain (DOMAIN1). RedHat Linux 5.5, Apache 2.n, Subversion 1.6.12. We decided to run subversion through Apache and
mod_dav_svn for connection flexibility; the subversion book recommended that method for flexibility in security, which we will need given our users.
Our Team: Mediocre Scripter (MS), Windows Sysadmin (WS), and Linux Sysadmin (LS).
LS does not have experience with Active Directory or communicating much with Windows servers. WS does not have much experience with Apache authentication. MS has some historical knowledge and some understanding of basic web protocols.
Approaches Ruled Out:
1) Basic authentication transmits username and password in clear text.
2) Digest authentication seems to have never been popular.
3) SSL would serve to encrypt authentication but would also bog the server down. Early tests indicate a transmission slowdown factor of 15. We really only need the username and password encrypted. Ordinarily, this wouldn't be an issue, but our users may be pushing Big Files in and out of subversion (whether or not it is appropriate, subversion has been politically mandated).
4) We certainly could assign separate usernames and passwords for just this task, but we're trying to move away from that kind of practice.
Where do we start with this? We will eventually want to authenticate against groups in DOMAIN1 containing some members in DOMAIN2, but that is for another day.