Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having a few problems getting SVN authentication to work with LDAP / Active Directory. My SVN installation works fine, but after enabling LDAP in my apache vhost, I just can't get my users to authenticate.

I can use a selection of LDAP browsers to successfully connect to Active Directory, but just can't seem to get this to work.

  • SVN is setup in /var/local/svn
  • Server is svn.domain.local
  • For testing, my repository is /var/local/svn/test

My vhost file is as follows:

<VirtualHost *:80>
        ServerAdmin alex@domain.com
        ServerAlias svn.domain.local
        ServerName svn.domain.local
        DocumentRoot /var/www/svn/

        <Location /test>
                DAV svn
                #SVNListParentPath On
                SVNPath /var/local/svn/test
                AuthzSVNAccessFile /var/local/svn/svnaccess
                AuthzLDAPAuthoritative off
                AuthType Basic
                AuthName "SVN Server"
                AuthBasicProvider ldap
                AuthLDAPBindDN "CN=adminuser,OU=SBSAdmin Users,OU=Users,OU=MyBusiness,DC=domain,DC=local"
                AuthLDAPBindPassword "admin password"
                AuthLDAPURL "ldap://192.168.1.6:389/OU=SBSUsers,OU=Users,OU=MyBusiness,DC=domain,DC=local?sAMAccountName?sub?(objectClass=*)"
                Require valid-user
        </Location>

        CustomLog /var/log/apache2/svn/access.log combined
        ErrorLog /var/log/apache2/svn/error.log
</VirtualHost>

In my error.log, I don't seem to get any bind errors (should I be looking elsewhere?), but just the following:

[Thu Jun 21 09:51:38 2012] [error] [client 192.168.1.142] user alex: authentication failure for "/test/": Password Mismatch, referer: http://svn.domain.local/test/

At the end of "AuthLDAPURL", I have seen people using TLS and NONE but neither seem to help in my case.

I have the ldap modules loaded and have checked as much as I know, so any help would be most welcome. Thanks

share|improve this question
add comment

migrated from stackoverflow.com Sep 24 '12 at 8:27

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 2 down vote accepted

Set REFERRALS off in the server /etc/ldap/ldap.conf and try again.

And try adding "NONE" to the URL line:

AuthLDAPURL "ldap://192.168.1.6:389/OU=SBSUsers,OU=Users,OU=MyBusiness,DC=domain,DC=local?sAMAccountName?sub?(objectClass=*)" NONE

Try ldapsearch. Do an .ldaprc in your home directory with this:

HOST 192.168.1.6
BASE DC=domain,DC=local
BINDDN CN=adminuser,OU=SBSAdmin Users,OU=Users,OU=MyBusiness,DC=domain,DC=local

Use it:

ldapsearch -D "CN=adminuser,OU=SBSAdmin Users,OU=Users,OU=MyBusiness,DC=domain,DC=local" -W sAMAccountName=user

It will ask for the BindDN password.

share|improve this answer
    
Afraid that doesn't seem to work. I get the same "authentication failure" messages in /var/log/apache2/svn/error.log - I'm certain that my password is correct, and my username is "alexh" and not "alexh@domain.local". Is there a way to get a more verbose output? –  Alex Holsgrove Jun 21 '12 at 10:10
1  
Would I be able to use this ldapsearch tool to confirm that I can connect? I've struggled to understand what parameters to pass to it. –  Alex Holsgrove Jun 21 '12 at 10:11
    
I've updated the solution with information about ldapsearch. –  Diego F. Durán Jun 21 '12 at 10:22
    
Thanks Diego. I created the .ldaprc file in /home/user and then ran the ldapsearch. It gave me: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1). I also tried this command and it seemed to work: ldapsearch -x -b "dc=domain,dc=local" -D "domain\adminuser" -h 192.168.1.6 -p 389 -W - does that tell you anything? –  Alex Holsgrove Jun 21 '12 at 10:25
    
OK, I made changes to my /etc/ldap/ldap.conf file and ran ldapsearch -x and it gave a bind error (LDAPv3) - error was "In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1" –  Alex Holsgrove Jun 21 '12 at 10:42
show 7 more comments

It may not directly answer your question, but did you consider to use Subversion Edge? It is free to use (AGPLv3 license).

As you can see in this screenshot it is quite simple to setup LDAP integration. You can even install the SSPI module though this requires some manual work.

share|improve this answer
    
Thanks Stefan, I'm open to alternatives, and I will give Subversion Edge a go. I'd still like to find an answer to my specific problem as well, as I have seen others with similar problems. Thanks again –  Alex Holsgrove Jul 2 '12 at 8:27
add comment

Diego gets the points as it finally led me to get it working. It may have been a case of changing the order of the params in my virtualhost, but this is what worked for me. I also copied the admin user DN directly from an LDAP GUI tool to ensure I had the correct bind details:

<VirtualHost *:80>
        ServerAdmin admin@domain.com
        ServerAlias svn.domain.local
        ServerName svn.domain.local
        DocumentRoot /var/www/svn/

        <Location />
                DAV svn
                SVNParentPath /var/local/svn/
                SVNListParentPath On
                AuthBasicProvider ldap
                AuthType Basic
                AuthzLDAPAuthoritative off
                AuthName "SVN Server"
                AuthLDAPURL "ldap://192.168.1.6:389/DC=domain,DC=local?sAMAccountName?sub?(objectClass=*)" NONE
                AUTHLDAPBindDN "CN=admin,OU=Admin Users,OU=Users,OU=MyBusiness,DC=domain,DC=local"
                AuthLDAPBindPassword ######
                require valid-user
        </Location>
</VirtualHost>

Hope that helps someone else out!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.