Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an svn set up at svn.example.com

I have the SVNParentPath set to list all repos in a directory.

When I enable my AuthzSVNAccessFile the listing page returns a 403 while I can correctly access repos directly at svn.example.com/repo name.

Apache conf:

<VirtualHost *:80>
        ServerName svn.example.com

        DocumentRoot /var/www/svn

        <Location />
                DAV svn
                AuthType Basic
                AuthName "svn.example.com"
                AuthUserFile /etc/apache2/svn/users.passwd
                AuthzSVNAccessFile /etc/apache2/svn/authz
                SVNParentPath /var/svn
                SVNListParentPath on

                Require valid-user
        </Location>

</VirtualHost>

Authz File:

[groups]
admin = user1. user2, user3

[/]
@admin = rw

Here is what I see in the error log;

The URI does not contain the name of a repository.  [403, #190001]
Could not fetch resource information.  [500, #0]
Could not open the requested SVN filesystem  [500, #2]
Could not open the requested SVN filesystem  [500, #2]

Access Log

svn.example.com:80 *myIP* - user1 [18/Nov/2010:13:56:53 +0000] "GET / HTTP/1.1" 403 274 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7"
share|improve this question

5 Answers 5

...have you tried a <Location /svn/> - with trailing slah! there: http://www.svnforum.org/2017/viewtopic.php?t=6443 people seem to have solved the problem for the 'non root-dir case.'

...then, at least, you know where to look further (mod-rewrite...?).

share|improve this answer
    
Yeah, that does work, but I want the listing in the root of the domain (svn.exmaple.com rather than the redundant svn.example.com/svn/). –  Simon Nov 26 '10 at 20:02

On further review, I second iiegn's answer. I was able to remove the problem with SVN 1.6.13 by adding a trailing slash and an alias without the slash like the article suggests.


Previous Response:

I found an answer to this on StackOverflow at http://stackoverflow.com/questions/488778/how-do-i-list-all-repositories-with-the-svnparentpath-directive-on-apachesvn, and it states to add:

SVNListParentPath On

This matches the what's at http://svnbook.red-bean.com/en/1.5/svn.ref.mod_dav_svn.conf.html, where it states:

SVNListParentPath On|Off

When set to On, allows a GET of SVNParentPath, which results in a listing of all repositories under that path. The default setting is Off.

This should fix the 403 problem.

share|improve this answer
    
I already have SVNListParentPath On, as shown in my question. This works when AuthzSVN is disabled, but when AuthzSVN is enabled I get the 403. –  Simon Nov 24 '10 at 10:04
    
Whoops! Sorry about that. –  brokenbeatnik Nov 26 '10 at 14:05

AuthzSVNAnonymous On AuthzSVNNoAuthWhenAnonymousAllowed On Satisfy Any

Firstly you need the Satisfy Any directive, also you will need the Anonymous lines if running a combined open / auth repo (i.e. I have some areas containing open source some closed source).

As I blogged here on upgrade: http://www.saiweb.co.uk/linux/mod_authz_svn-mod_dav_svn-prompting-for-password

Verify that SVNParentPath /var/svn path exists at /var/svn and it is accessible and writable by the apache use, chances are you left this owned by root:root chown -R apache:apache /var/svn

share|improve this answer
    
Thanks for your comments - I don't want any anonymous access - I want it to always prompt for a user - but I want the root to list accessible repos (i.e repos the user has permission to read). At the moment even authorised users get 403 on the parent path while repos do work. I have checked perms on /var/svn they are correct –  Simon Nov 18 '10 at 13:40
    
The error log Could not open the requested SVN filesystem [500] suggests otherwise, are you running with SELinux enabled? what are the results of getenforce ? can you please also provide a line from the access_log that shows the URI causing the 403? –  Oneiroi Nov 18 '10 at 13:46
    
It's the root path (svn.example.com) that is causing the 403 (line from access log added to my original post). URL's that actually are reading from the SVN file system (evn.example.com/repos1) work as expected. getenforce: command not found –  Simon Nov 18 '10 at 14:03
    
I found that the "Could not open the requested SVN filesystem [500]" message was actually coming from the request for a favicon (svn.example.com/favicon.ico), I've blocked that and no longer get the above error but I still get the 403 errors –  Simon Nov 18 '10 at 15:33

I'm having the same issue, hosting Subversion on its own subdomain. It seems like there needs to be a configuration like [], but that seems to just cause a silent error, rendering the file to be ignored altogether. Here's the jist of a workaround that I can't get to work, but might give you some ideas:

  1. Redirect / to /index/ (or whatever suits your taste)
  2. Duplicate the <location /> section and rename the first one to <location /index/> section
  3. Add a rewrite rule matching /index/* to redirect to /$1
  4. Add an [/index/] section to the authz file

I spent a few minutes trying this out, but didn't have much luck. I'll update this answer if I find a way to make that work, or a better solution.

share|improve this answer

I had the same problem and found the following workaround. Main idea is to not apply "AuthzSVNAccessFile" to the root but apply for the rest. Works for me in apache2.2 (Ubuntu Server 12.04).

<VirtualHost *:80>
    ...
    <Location />
        ...
    </Location>
    <Location /.+>
        AuthzSVNAccessFile /path/to/the/access/file
    </Location>
</VirtualHost>

Update (full config):

<VirtualHost *:80>
    ServerAdmin helpdesk@company.com
    ServerName svn.company.lan
    <Location />
        # Enable Subversion
        DAV svn

        # Directory containing all repository for this path
        SVNListParentPath on
        SVNParentPath /opt/subversion

        # LDAP Authentication & Authorization is final; do not check other databases
        AuthzLDAPAuthoritative on
        AuthBasicProvider ldap

        # Do basic password authentication in the clear
        AuthType Basic

        # The name of the protected area or "realm"
        AuthName "Subversion Repository"

        # The LDAP query URL
        # Format: scheme://host:port/basedn?attribute?scope?filter
        # The URL below will search for all objects recursively below the basedn 
        # and validate against the sAMAccountName attribute
        AuthLDAPURL "ldap://dc1.company.com/dc=serv,dc=company,dc=com?sAMAccountName?sub"
        AuthLDAPBindDN "CN=svn1user,OU=ou1,DC=company,DC=com"
        AuthLDAPBindPassword "PASS"

        # Require authentication for this Location
        Require valid-user
    </Location>

    # <LocationMatch /.+> is a really dirty trick to make listing of repositories work (http://d.hatena.ne.jp/shimonoakio/20080130/1201686016)
    <LocationMatch /.+>
        AuthzSVNAccessFile /opt/subversion/subversion.perm
    </LocationMatch>
</VirtualHost>
share|improve this answer
    
No, it wouldn't, please have a look to the answer again, I've added a full config that we use in production. –  giner May 16 '13 at 11:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.