Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a new repository on an existing subversion server that requires us to perform path based authorization within the repository. I found that the AuthzSVNAccessFile directive in apache is directly responsible for allowing this functionality. After fixing several other problems such as AuthzSVNAccessFile preventing SVNListParentPath from operating properly, I am left with one single problem. I can checkout, I can update, I can commit, BUT I cannot execute an SVN COPY for performing branch/tagging operations. The moment I comment out the AuthzSVNAccessFile line in the Apache config everything works as expected except the obvious path authorizations.

Versions:

  • The server OS is Debian 6.0.7 (Squeeze)
  • Apache 2.2.16-6+squeeze11
  • Server Subversion 1.6.12dfsg-7
  • Clients are running windows
  • Clients tried are:
    • TortoiseSVN 1.8.2 Build 24708 64bit
    • SVN CLI Client 1.8.3 (r1516576)

Authentication is performed via AD to a Windows 2003 domain and appears to be operating normally. I have stripped out all other configurations and repository setups to produce this single configuration that reproduces the problem.

Apache Configuration:

<VirtualHost *:443>
    ServerName svn-test.company.com
    ServerAlias /svn-test
    ServerAdmin me@mycompany.com
    SSLEngine On
    SSLCertificateFile /etc/apache2/apache.pem

    ErrorLog /var/log/apache2/svn-test_error.log
    LogLevel warn 
    CustomLog /var/log/apache2/svn-test_access.log combined
    ServerSignature On

    # Repository Access to all Repositories
    <Location "/">
        DAV svn
        SVNParentPath /var/svn
        SVNListParentPath on

        AuthBasicProvider ldap
        AuthType Basic
        AuthzLDAPAuthoritative Off
        AuthName "Subversion Test Repository System"

        AuthLDAPURL "ldap://adserver.company.com:389/DC=corp,DC=company,DC=com?sAMAccountName?sub?(objectClass=*)" NONE
        AuthLDAPBindDN "CN=service_account,OU=ServiceIDs,OU=corp,OU=Delegated,DC=na,DC=corp,DC=company,DC=com"
        AuthLDAPBindPassword service_account_password
        Require valid-user
        SSLRequireSSL
    </Location>

    # <LocationMatch /.+> is a really dirty trick to make listing of repositories work
    # http://d.hatena.ne.jp/shimonoakio/20080130/1201686016
    <LocationMatch /.+>
        AuthzSVNAccessFile /etc/apache2/svn_path_auth
    </LocationMatch>

</VirtualHost>


SVN Access File:

[/]
* = rw


The repository used (AuthTestBasic) consists of the following directory structure and contains no externals (this is a literal listing, not an example):

/
/branches/
/tags/
/trunk/
/trunk/somefile.txt

Tortoise produces the following error during a tag operation in it's tag result window:

Adding directory failed: COPY on /authtestbasic/!svn/bc/2/trunk (400 Bad Request)

The svn.exe CLI client produces the following error:

C:\Users\e20epkt>svn copy https://servername/authtestbasic/trunk https://servername/authtestbasic/tags/tag1 -m "svn cli client"
svn: E175002: Adding directory failed: COPY on /authtestbasic/!svn/bc/2/trunk (400 Bad Request)

The Apache error log has nothing in it, however the apache access log has the following in it (IP addresses and usernames changed obviously):

10.1.2.100 - - [17/Oct/2013:11:53:40 -0700] "OPTIONS /authtestbasic/trunk HTTP/1.1" 401 2595 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "OPTIONS /authtestbasic/trunk HTTP/1.1" 200 996 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "OPTIONS /authtestbasic/trunk HTTP/1.1" 200 884 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "PROPFIND /authtestbasic/trunk HTTP/1.1" 207 692 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "PROPFIND /authtestbasic/!svn/vcc/default HTTP/1.1" 207 596 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "REPORT /authtestbasic/!svn/bc/0/trunk HTTP/1.1" 404 580 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "PROPFIND /authtestbasic/!svn/vcc/default HTTP/1.1" 207 596 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "REPORT /authtestbasic/!svn/bc/2/trunk HTTP/1.1" 200 674 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "PROPFIND /authtestbasic/!svn/bc/2/trunk HTTP/1.1" 207 548 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "PROPFIND /authtestbasic/tags/tag1 HTTP/1.1" 404 580 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "MKACTIVITY /authtestbasic/!svn/act/f1e9dc07-fb5e-5a41-ac22-907705ef6e5e HTTP/1.1" 201 708 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "PROPFIND /authtestbasic/tags HTTP/1.1" 207 580 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "CHECKOUT /authtestbasic/!svn/vcc/default HTTP/1.1" 201 708 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "PROPPATCH /authtestbasic/!svn/wbl/f1e9dc07-fb5e-5a41-ac22-907705ef6e5e/2 HTTP/1.1" 207 596 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "CHECKOUT /authtestbasic/!svn/ver/1/tags HTTP/1.1" 201 724 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "COPY /authtestbasic/!svn/bc/2/trunk HTTP/1.1" 400 596 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"
10.1.2.100 - myuseraccount [17/Oct/2013:11:53:40 -0700] "DELETE /authtestbasic/!svn/act/f1e9dc07-fb5e-5a41-ac22-907705ef6e5e HTTP/1.1" 204 1956 "-" "SVN/1.8.3 (x64-microsoft-windows) serf/1.3.1 TortoiseSVN-1.8.2.24708"

You'll see that the second to last line contains the COPY command with the HTTP 400 response, however, there doesn't appear to be any indication as to why.

Please note that, while yes this is a test repository on a test server, I am experiencing this same issue in this test setup where I have eliminated all other possible causes (mixed repository configurations, externals, etc). I have also confirmed that all files for the repository (/var/svn/authtestbasic) are owned by the Apache user www-data.

share|improve this question
    
Nothing at all in the error log, like no startup messages? Could the active log be elsewhere? –  Shane Madden Oct 17 '13 at 19:52
    
It does contain the startup message and any errors I deliberately generate (ie, 404). Just nothing about this including not having the 400 error shown in the access log. –  meeper Oct 17 '13 at 20:02
    
Strange. Does it still happen if AuthzSVNAccessFile is in the <Location /> block? –  Shane Madden Oct 18 '13 at 6:34
    
Wow, moving the AuthzSVNAccessFile back to the <Location /> block worked, however, that prevents me from listing the available repositories which is why it was in the <LocationMatch /.+> block. It is closer to anything else I've come across though. Any idea how to combine these two pieces? –  meeper Oct 18 '13 at 19:28
    
I finally found the bug about the two directives not cooperating. In that bug I found that they tried this same workaround and how it caused this same error. It would seem that there is no way to combine these two directives on my current version. They have released a patch to fix this problem in a later version of subversion then I currently have. I guess I'll just have to wait for Debian to update to a later version to regain the repository listing (manual compile is not an option). Until then it'll have to be broken. @ShaneMadden - did you want to answer so I check it off or shall I? –  meeper Oct 18 '13 at 20:23

1 Answer 1

up vote 0 down vote accepted

This bug describes the problem with AuthzSVNAccessFile when combined with SVNListParentPath, and also mentions that the <LocationMatch /.+> workaround breaks copy commands.

What version of SVN are you running? Since that was patched in 2010 I would hope that distros have that version incorporated by now..

share|improve this answer
    
As stated in the question, I'm running version 1.6.12dfsg-7 on the server which is the latest Debian has for Squeeze (6.0.7). Debian Wheezy (current stable) isn't much better at 1.6.17dfsg-4+deb7u4. I'll have to wait until Jessie is released as stable as it has 1.7.9-1+nmu4 –  meeper Oct 18 '13 at 20:32
    
@meeper From the comments on that bug it looked like they had backported the fix to 1.6.12? That's no guarantee that Debian integrated the fix but the newer 1.6 might be worth a shot. –  Shane Madden Oct 18 '13 at 20:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.