Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm using Apache 2.4, and I wish to use it without mod_access_compat.

I'm trying to serve SVN repositories, with access control handled by mod_authz_svn.

I want some repos or locations within repos to have read-only anonymous access. I want other repos or locations to require basic authentication.

Apache 2.4 no longer supports the Satisfy all syntax, however, mod_authz_svn seems to expect it. How is this supposed to be configured on Apache 2.4?

Apache config:

 <Location /svn>
        DAV svn
        SVNParentPath /usr/projects/svn
        AuthType Basic
        AuthName "SVN repository"
        AuthUserFile /usr/project-config/etc/svn-auth-file
        AuthzSVNAccessFile /usr/project-config/etc/svn-access-control
        Require valid-user
 </Location>

svn-access-control:

# cat etc/svn-access-control
[/]
antiduh = rw

[openprojects:/]
* = r
antiduh = rw

I have 5 repos, openprojects is the only one I want to have anonymous read-only access to. I cannot seem to get this to work. Even the most recent documentation I could find for mod_authz_svn continues to use Satisfy all.

share|improve this question
    
Why don't you want to use mod_access_compat? –  Moshe Katz Jun 19 at 20:16
    
I can, I just don't want to. If Apache has changed the auth/access model, I want to find out how to do things in the new model. –  antiduh Jun 19 at 20:18
    
Poking around in mod_authz_svn's source, it's looking like it has a hard dependency on ap_satisfies(r) == SATISFY_ANY. I think that means it isn't supported outside of mod_access_compat, but I'll leave the question up for a while if someone else can think of something. –  antiduh Jun 19 at 20:54

2 Answers 2

In most cases, the 2.4 equivalent of Satisfy All is to enclose the Require directives in a <RequireAll> block. The equivalent of Satisfy Any would be a <RequireAny> block.

For more information on the changes and equivalents, this presentation (PDF) by Rich Bowen might be helpful.

share|improve this answer
    
I had tried that - <RequireAny>Require valid-user</RequireAny> is what I tried, which doesn't really make a lot of sense, but its all I can attempt. –  antiduh Jun 19 at 20:51
up vote 0 down vote accepted

Poking around in mod_authz_svn's source, it's looking like it has a hard dependency on ap_satisfies(r) == SATISFY_ANY. I'm not entirely familiar with the Apache API model, but this would appear to indicate that mod_authz_svn does not currently support Apache 2.4's new authentication model.

Since nobody else has come up with an answer or with contrary evidence, I'm going to mark this as the answer.

To make this work under Apache 2.4, load the mod_access_compat module:

LoadModule access_compat_module libexec/apache24/mod_access_compat.so

And then add the Satisfy any clause, just as the documentation currently indicates.

 <Location /svn>
    DAV svn
    SVNParentPath /usr/home/antiduh/svn
    AuthType Basic
    AuthName "SVN repository"
    AuthUserFile /usr/home/antiduh/svn/etc/svn-auth-file
    AuthzSVNAccessFile /usr/home/antiduh/svn/etc/svn-access-control
    Satisfy any
    Require valid-user
 </Location>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.