Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to make use of LDAP groups in my Subversion Edge "Repository Access Rules".

For example, if LDAP user smokris is a member of LDAP group dev, I'd like to be able to grant the dev group access to test-repository, without having to explicitly add each member of group dev to the Repository Access Rules.

What's the syntax for that?

I tried:

[test-repository:/]
dev=rw

[/]
*=

...but user smokris is denied access.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Download https://bitbucket.org/whitlockjc/jw-tools.

Create an executable script like the following (substitute in your directories and LDAP configuration):

#!/bin/bash

CSVN_DIR=/home/csvn
JW_TOOLS_DIR=/home/csvn/jw-tools

# truncate the access file after the generated-content tag
perl -0777 -pe 's/\n\n\n### Start generated content.*//s' \
    < $CSVN_DIR/data/conf/svn_access_file \
    > $CSVN_DIR/data/conf/svn_access_file.tmp

# append the latest LDAP group configuration
$JW_TOOLS_DIR/sync_ldap_groups_to_svn_authz/sync_ldap_groups_to_svn_authz.py \
    --url="..." \
    --bind-dn="..." --bind-password="..." \
    --base-dn="..." \
    --group-query="objectClass=posixGroup" \
    --group-member-attribute="memberUid" \
    --user-query="objectClass=posixAccount" \
    --userid_attribute="uid" \
    --quiet \
    | grep -v '^\[groups\]' \
    >> $CSVN_DIR/data/conf/svn_access_file.tmp

mv -f $CSVN_DIR/data/conf/svn_access_file.tmp $CSVN_DIR/data/conf/svn_access_file

Run the script periodically from cron:

0 * * * * ~/update-ldap-groups
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.