Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running an apache instance on a local server and wan't to require a username plus a corresponding certificate to authenticate/authorize users for a subversion repository. That's my current server conf: What directives do I need to require a username?

<VirtualHost *:443>
    ServerAdmin  webmaster@localhost
    DocumentRoot /var/www
    ServerSignature On
    SSLEngine on
    SSLCertificateFile /opt/ssl/ServerCA/server/certs/ServerWeb.crt
    SSLCertificateKeyFile /opt/ssl/ServerCA/server/keys/ServerWeb.key
    SSLCACertificateFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLCertificateChainFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLVerifyClient optional
    SSLVerifyDepth 2

    <Location /repo>
        DAV svn
        SVNPath /srv/repos/svn/insec
        SSLRequireSSL
        AuthzSVNAccessFile /srv/repos/svn/insec/conf/authz
        AuthType Basic
        AuthName "Subversion repository"
        Require valid-user
    </Location>
</VirtualHost>

edit: added SSLCertificateChainFile so the client gets the ca cert if it is not already installed.
edit 2: So one last thing: how do I match a specific certificate to a username?

share|improve this question
    
Umm..i maybe wrong here, but my understanding is that ssl doesn't require a username. Is username a seperate requirement for you here? –  Anand Jeyahar May 15 '11 at 12:08
    
Yes, it is, but i need it so that commits to the repo are associated with a username, otherwise they appear as from "no user". –  icefex May 15 '11 at 12:13
    
Ah that is more on svn configuration. will refresh my memory and get back... –  Anand Jeyahar May 15 '11 at 12:40
    
Just for reference, i used this guide: stylesen.org/… on a turnkey linux appliance. –  icefex May 15 '11 at 12:43
    
Tell me this how are the users executing the commit?? There are 2 levels of authentication involved (apache and svn). what is your svn configuration? –  Anand Jeyahar May 15 '11 at 13:06
show 3 more comments

1 Answer 1

up vote 0 down vote accepted

Okay, I got it working now, for further reference here my conf:

<VirtualHost *:443>
    ServerAdmin  webmaster@localhost
    DocumentRoot /var/www
    ServerSignature On
    SSLEngine on
    SSLCertificateFile /opt/ssl/ServerCA/server/certs/ServerWeb.crt
    SSLCertificateKeyFile /opt/ssl/ServerCA/server/keys/ServerWeb.key
    SSLCACertificateFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLCertificateChainFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLVerifyClient optional
    SSLVerifyDepth 2
    SSLUserName SSL_CLIENT_S_DN_CN # that line tells apache to use the common name of the client certificate as the username, that's what i was still missing.

    <Location /repo>
        DAV svn
        SVNPath /path/to/repo/
        SSLRequireSSL
        AuthzSVNAccessFile /path/to/repo/conf/authz
    </Location>
</VirtualHost>
share|improve this answer
    
Just out of curiousity, can you describe how your application works? It seems you provide repository access via apache(and therefore browser). Was wondering if it is just files storage(addition/deletion) or document editing too?? –  Anand Jeyahar May 16 '11 at 9:38
    
I don't understand what exactly you mean but it is your usual svn over https setup just with certificates and not with user/pass. –  icefex May 16 '11 at 13:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.