Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When using Apache2 with client certificates and FakeBasicAuth, how do I refer to users in the AuthzSVNAccessFile? The usernames have funny characters, like /CN=Damon Wischik, and authz doesn't like the = character in usernames.

My Apache configuration has the lines

    SSLVerifyClient require
    SSLOptions +FakeBasicAuth

This means that the user provides a client certificate, Apache takes the subject line from the certificate e.g. /CN=Damon Wischik, and uses that as the username and "password" as the password. I've added an htpasswd entry for this user, and he can log on happily.

Now I want to add fine-grained access control to the repository, and I can't work out how to refer to this username in the AuthzSVNAccessFile. I started off with

* = r

and the user was able to read the contents of the repository. I tried writing

* =
"/CN=Damon Wischik" = r

and the user gets "Access forbidden", and the Apache error log says

[date] [error] [client ip] Failed to load the AuthzSVNAccessFile: The character 'D' in rule '"/CN' is not allowed in authz rules
[date] [error] [client ip] Access denied: '/CN=Damon Wischik' GET foo:/

What's the correct way to escape these funny characters in usernames, in the authz file?

share|improve this question
This isn't my area of expertise, but generally speaking you'd escape a character by using a backslash before the character. – Jenny D Oct 8 '12 at 7:03
If I try username /CN\=Damon Wischik, I get the error message: "The character 'D' in rule '/CN\\' is not allowed in authz rules" – DamonJW Oct 8 '12 at 7:42

(Thanks to Stefan Sperling on the subversion-users mailing list for the answer.) RTFM! From the red bean book chapter 6,

Subversion 1.5 brought several useful features to the access file syntax—username aliases, authentication class tokens, and a new rule exclusion mechanism—all of which further simplify the maintenance of the access file.

Here is how to use aliases in this particular case.

djw = /CN=Damon Wischik

* = 
&djw = r
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.