3

I have an svn set up at svn.example.com

I have the SVNParentPath set to list all repos in a directory.

When I enable my AuthzSVNAccessFile the listing page returns a 403 while I can correctly access repos directly at svn.example.com/repo name.

Apache conf:

<VirtualHost *:80>
        ServerName svn.example.com

        DocumentRoot /var/www/svn

        <Location />
                DAV svn
                AuthType Basic
                AuthName "svn.example.com"
                AuthUserFile /etc/apache2/svn/users.passwd
                AuthzSVNAccessFile /etc/apache2/svn/authz
                SVNParentPath /var/svn
                SVNListParentPath on

                Require valid-user
        </Location>

</VirtualHost>

Authz File:

[groups]
admin = user1. user2, user3

[/]
@admin = rw

Here is what I see in the error log;

The URI does not contain the name of a repository.  [403, #190001]
Could not fetch resource information.  [500, #0]
Could not open the requested SVN filesystem  [500, #2]
Could not open the requested SVN filesystem  [500, #2]

Access Log

svn.example.com:80 *myIP* - user1 [18/Nov/2010:13:56:53 +0000] "GET / HTTP/1.1" 403 274 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7"

5 Answers 5

3

On further review, I second iiegn's answer. I was able to remove the problem with SVN 1.6.13 by adding a trailing slash and an alias without the slash like the article suggests.


Previous Response:

I found an answer to this on StackOverflow at https://stackoverflow.com/questions/488778/how-do-i-list-all-repositories-with-the-svnparentpath-directive-on-apachesvn, and it states to add:

SVNListParentPath On

This matches the what's at http://svnbook.red-bean.com/en/1.5/svn.ref.mod_dav_svn.conf.html, where it states:

SVNListParentPath On|Off

When set to On, allows a GET of SVNParentPath, which results in a listing of all repositories under that path. The default setting is Off.

This should fix the 403 problem.

3
  • I already have SVNListParentPath On, as shown in my question. This works when AuthzSVN is disabled, but when AuthzSVN is enabled I get the 403.
    – Simon
    Nov 24, 2010 at 10:04
  • Whoops! Sorry about that. Nov 26, 2010 at 14:05
  • I have auth using AuthType Basic and a file and found the same issue. Adding SVNLIstParentPath fixed the issue. Wierdly it's worked without that for years.
    – Jay M
    Aug 7, 2019 at 7:59
2

...have you tried a <Location /svn/> - with trailing slah! there: http://www.svnforum.org/2017/viewtopic.php?t=6443 people seem to have solved the problem for the 'non root-dir case.'

...then, at least, you know where to look further (mod-rewrite...?).

1
  • Yeah, that does work, but I want the listing in the root of the domain (svn.exmaple.com rather than the redundant svn.example.com/svn/).
    – Simon
    Nov 26, 2010 at 20:02
0
AuthzSVNAnonymous On
AuthzSVNNoAuthWhenAnonymousAllowed On
Satisfy Any

Firstly you need the Satisfy Any directive, also you will need the Anonymous lines if running a combined open / auth repo (i.e. I have some areas containing open source some closed source).

As I blogged here on upgrade: http://www.saiweb.co.uk/linux/mod_authz_svn-mod_dav_svn-prompting-for-password

Verify that SVNParentPath /var/svn path exists at /var/svn and it is accessible and writable by the apache use, chances are you left this owned by root:root chown -R apache:apache /var/svn

4
  • Thanks for your comments - I don't want any anonymous access - I want it to always prompt for a user - but I want the root to list accessible repos (i.e repos the user has permission to read). At the moment even authorised users get 403 on the parent path while repos do work. I have checked perms on /var/svn they are correct
    – Simon
    Nov 18, 2010 at 13:40
  • The error log Could not open the requested SVN filesystem [500] suggests otherwise, are you running with SELinux enabled? what are the results of getenforce ? can you please also provide a line from the access_log that shows the URI causing the 403?
    – Oneiroi
    Nov 18, 2010 at 13:46
  • It's the root path (svn.example.com) that is causing the 403 (line from access log added to my original post). URL's that actually are reading from the SVN file system (evn.example.com/repos1) work as expected. getenforce: command not found
    – Simon
    Nov 18, 2010 at 14:03
  • I found that the "Could not open the requested SVN filesystem [500]" message was actually coming from the request for a favicon (svn.example.com/favicon.ico), I've blocked that and no longer get the above error but I still get the 403 errors
    – Simon
    Nov 18, 2010 at 15:33
0

I'm having the same issue, hosting Subversion on its own subdomain. It seems like there needs to be a configuration like [], but that seems to just cause a silent error, rendering the file to be ignored altogether. Here's the jist of a workaround that I can't get to work, but might give you some ideas:

  1. Redirect / to /index/ (or whatever suits your taste)
  2. Duplicate the <location /> section and rename the first one to <location /index/> section
  3. Add a rewrite rule matching /index/* to redirect to /$1
  4. Add an [/index/] section to the authz file

I spent a few minutes trying this out, but didn't have much luck. I'll update this answer if I find a way to make that work, or a better solution.

0

I had the same problem and found the following workaround. Main idea is to not apply "AuthzSVNAccessFile" to the root but apply for the rest. Works for me in apache2.2 (Ubuntu Server 12.04).

<VirtualHost *:80>
    ...
    <Location />
        ...
    </Location>
    <Location /.+>
        AuthzSVNAccessFile /path/to/the/access/file
    </Location>
</VirtualHost>

Update (full config):

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName svn.company.lan
    <Location />
        # Enable Subversion
        DAV svn

        # Directory containing all repository for this path
        SVNListParentPath on
        SVNParentPath /opt/subversion

        # LDAP Authentication & Authorization is final; do not check other databases
        AuthzLDAPAuthoritative on
        AuthBasicProvider ldap

        # Do basic password authentication in the clear
        AuthType Basic

        # The name of the protected area or "realm"
        AuthName "Subversion Repository"

        # The LDAP query URL
        # Format: scheme://host:port/basedn?attribute?scope?filter
        # The URL below will search for all objects recursively below the basedn 
        # and validate against the sAMAccountName attribute
        AuthLDAPURL "ldap://dc1.company.com/dc=serv,dc=company,dc=com?sAMAccountName?sub"
        AuthLDAPBindDN "CN=svn1user,OU=ou1,DC=company,DC=com"
        AuthLDAPBindPassword "PASS"

        # Require authentication for this Location
        Require valid-user
    </Location>

    # <LocationMatch /.+> is a really dirty trick to make listing of repositories work (http://d.hatena.ne.jp/shimonoakio/20080130/1201686016)
    <LocationMatch /.+>
        AuthzSVNAccessFile /opt/subversion/subversion.perm
    </LocationMatch>
</VirtualHost>
1
  • No, it wouldn't, please have a look to the answer again, I've added a full config that we use in production. May 16, 2013 at 11:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .