1

I have a unique scenario here - one that probably has come up in the past. I have a directory that is being protected by an LDAP authentication on my Apache server. In this directory (call it /svn - yes, it's a subversion directory), there are projects as subdirectories.

I want to restrict the users who gain access to this subdirectory based on a group file. However, I don't want to add a special line in my httpd.conf file for every project that gets created. Instead, the URL of the subdirectory will match the name of the group.

So for example, I may have the project "calendar". My SVN URL would be "http://myserver.com/svn/caldendar" - and the only users who should have access to this repository would be listed in my groups.txt file as:

calendar:user1 user2

So even if someone can authenticate against LDAP, only user1 and user2 should be allowed in.

Is there an easier way to do this? Perhaps setup a variable for the subdirectory and say Require ldap-group variable?

Thanks!

1 Answer 1

1

After further investigation, I found the solution in the form of SVN Access control.

Using authz_svn_module, my Subversion directory in the Apache configuration looks like:

<Location /svn>
  # Tell apache this is a subversion repository
  DAV svn
  # Where the subversion repository list exists on the file system
  SVNParentPath "/var/svn"
  # What kind of authentication     
  AuthType Basic
  AuthName "Restricted!"
  AuthBasicProvider ldap
  AuthLDAPBindDN "YOUR BIND DN"
  AuthLDAPBindPassword "YOUR BIND PASSWORD"
  AuthLDAPURL "ldaps://yourldapserver.com:636/other_info"
  AuthzSVNAccessFile /etc/httpd/svnaccess.txt
  Require valid-user
</Location>

Pretty basic - the important line here is the AuthzSVNAccessFile - this points to the file that will be generated automatically and hold which users have permission to which directories.

This "svnaccess.txt" file would look something like this:

[project1:/]
joe_user = rw
mary_beth = rw
$anonymous = r

[project2:/]
james_smith = rw

[project3:/]
john_deere = rw
$anonymous = r

The usernames listed here are the usernames authenticated by LDAP. They do not need to be registered by Subversion (they're carried with the user upon authentication). The @anonymous is a wild-card: anyone that is not authenticated, or that may satisfy another Allow directive in your Apache configuration. This file should only be readable by root (or whoever starts the Apache service).

The creation of this file can be automatically generated - depending on where your information is coming from. In my case, I have a Redmine server that holds information about users and projects, and which user has access to which project. A short Python script can be written to extract that information from the database and used to generate this file automatically (if used as a cron job). It's a round-about way of doing things, but after you get it working and automated, you don't have to worry about rewriting authentication rules again for each new project/subversion repository created.

(And on the plus side, changes to this "svnaccess.txt" file doesn't require an Apache restart!)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .