Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have working svnserve solution on Ubuntu 10.04 for authorizing svn users over SASL to Active directory (LDAP, not LDAPDB). Config files are at the bottom.

After upgrading server to 12.04 release, this does not work anymore. I can authorize user over SASL to LDAP with

 testsaslauthd -u ldap_username -p his_password
 => 0: OK "Success."

But when i try to "svn update" on folder at the same server, it ask me three times for credentials and end with

 svn: Authentication error from server: SASL(-4): no mechanism available:

I do not know how to track communication between svn and sasl.

Circumstances:

  • Ubuntu 10.04 + subversion 1.6.6 (with Cirrus SASL support) => working
  • Ubuntu 12.04 + subversion 1.6.17 (with Cirrus SASL support) => not working (with same configuration)

file /usr/lib/sasl2/svn.conf

 pwcheck_method: saslauthd
 auxprop_plugin: ldap
 mech_list: PLAIN

file /usr/lib/sasl2/subversion.conf -> symlink to /usr/lib/sasl2/svn.conf

file /opt/svn/repos/conf/svnserve.conf

 [general]
 anon-access = none
 auth-access = write
 #password-db = passwd
 authz-db = authz
 realm = smartsvn

 [sasl]
 use-sasl = true
 min-encryption = 0
 max-encryption = 256

Any idea, how to fixit or trace the problem?

share|improve this question

migrated from stackoverflow.com Oct 12 '12 at 13:48

This question came from our site for professional and enthusiast programmers.

3 Answers 3

Had the same problems like above only on debian squeeze after a dist-upgrade. After hours of config, restart and reinstalling madness I gave following "svn.conf" a try:

pwcheck_method: saslauthd
#auxprop_plugin: ldap
mech_list: plain login cram-md5 digest-md5

IMO, "mech_list: plain" should be enough. the other mechs are overlefts from previous tryouts.

Here is my /etc/saslauthd.conf

ldap_servers: ldap://xxx.xxx.xxx.xxx
ldap_use_sasl:no
ldap_search_base: DC=domain,DC=tdl
ldap_bind_dn: xxxx@domain.tdl
ldap_bind_pw: magic_word:)
ldap_mech: PLAIN
ldap_auth_method: bind
ldap_filter: (sAMAccountName=%U)
log_level: 7

And here my /etc/default/saslauthd

START=yes
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="ldap"
MECH_OPTIONS=""
THREADS=5
share|improve this answer
    
Yes, this finally helps! After restart of saslauthd and svnserve. Mazbe the key is case in mech_list: plain login instead mech_list: PLAIN LOGIN –  Foton Jul 11 '13 at 10:08

(1) In /etc/sasl2/svn.conf you can set a log level for saslauthd like:

log_level: 7

In sasl.h I found:

#define SASL_LOG_NONE  0    /* don't log anything */
#define SASL_LOG_ERR   1    /* log unusual errors (default) */
#define SASL_LOG_FAIL  2    /* log all authentication failures */
#define SASL_LOG_WARN  3    /* log non-fatal warnings */
#define SASL_LOG_NOTE  4    /* more verbose than LOG_WARN */
#define SASL_LOG_DEBUG 5    /* more verbose than LOG_NOTE */
#define SASL_LOG_TRACE 6    /* traces of internal protocols */
#define SASL_LOG_PASS  7    /* traces of internal protocols, including passwords */

It seems it logs to /var/log/auth.log.

I have almost the same problem (migrating from Ubuntu 11.04 to 12.04) and get in auth.log:

svnserve: could not find auxprop plugin, was searching for 'ldap'

Interestingly, the log says "svnserve" and not saslauthd. Which lead me to ...

(2) You could try

ldd /usr/bin/svnserve

For me, the working server (Ubuntu 11.04) shows:

libldap_r-2.4.so.2 => /usr/lib/libldap_r-2.4.so.2

but the failing server (12.04) does not.

share|improve this answer
    
I filed a question with canonical's ubuntu launchpad:answers.launchpad.net/ubuntu/+source/subversion/+question/… –  klaus thorn Mar 27 '13 at 9:47
    
Became a bug now: bugs.launchpad.net/ubuntu/+source/subversion/+bug/1160896 –  klaus thorn Mar 27 '13 at 13:37
    
I see, thanks. After raising log level I have similiar error to yours: –  Foton Mar 28 '13 at 9:08
    
I see, thanks. After raising log level I have similiar error to yours: svnserve: could not find auxprop plugin, was searching for 'ldapdb' (Marcin configuration). I tried also change configuration in /usr/lib/sasl2/svn.conf to auxprop_plugin: ldap but error is just switch to svnserve: could not find auxprop plugin, was searching for 'ldap'. –  Foton Mar 28 '13 at 9:24
    
After not getting an answer in the svn users mailing list, I now resort to using Apache and https:// instead of svn://. LDAP works there and it is much more secure anyway. I tried to avoid this because http used to take 60% longer for a checkout (with my use case here), but newer tests show that this is less of an issue with subversion 1.8 on the server side and on the client side together with serf (instead of neon). –  klaus thorn Sep 17 '13 at 16:40

Try changeing configuration to your /usr/lib/sasl2/svn.conf config file (SVN sasl configuration):

auxprop_plugin: ldapdb
mech_list: PLAIN
ldapdb_mech: PLAIN
saslauthd_path: /var/run/saslauthd/mux
ldapdb_uri: <address of your ldap server (ldap://hostname)>
share|improve this answer
    
Thanks for answer, but didnot work. I updated svn.conf, restart svnserve and saslauthd, but error is the same. –  Foton Jan 29 '13 at 12:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.