Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to make use of LDAP groups in my Subversion Edge "Repository Access Rules".

For example, if LDAP user smokris is a member of LDAP group dev, I'd like to be able to grant the dev group access to test-repository, without having to explicitly add each member of group dev to the Repository Access Rules.

What's the syntax for that?

I tried:

[test-repository:/]
dev=rw

[/]
*=

...but user smokris is denied access.

share|improve this question
up vote 0 down vote accepted

Download https://bitbucket.org/whitlockjc/jw-tools.

Create an executable script like the following (substitute in your directories and LDAP configuration):

#!/bin/bash

CSVN_DIR=/home/csvn
JW_TOOLS_DIR=/home/csvn/jw-tools

# truncate the access file after the generated-content tag
perl -0777 -pe 's/\n\n\n### Start generated content.*//s' \
    < $CSVN_DIR/data/conf/svn_access_file \
    > $CSVN_DIR/data/conf/svn_access_file.tmp

# append the latest LDAP group configuration
$JW_TOOLS_DIR/sync_ldap_groups_to_svn_authz/sync_ldap_groups_to_svn_authz.py \
    --url="..." \
    --bind-dn="..." --bind-password="..." \
    --base-dn="..." \
    --group-query="objectClass=posixGroup" \
    --group-member-attribute="memberUid" \
    --user-query="objectClass=posixAccount" \
    --userid_attribute="uid" \
    --quiet \
    | grep -v '^\[groups\]' \
    >> $CSVN_DIR/data/conf/svn_access_file.tmp

mv -f $CSVN_DIR/data/conf/svn_access_file.tmp $CSVN_DIR/data/conf/svn_access_file

Run the script periodically from cron:

0 * * * * ~/update-ldap-groups
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.