2

I'm running an apache instance on a local server and wan't to require a username plus a corresponding certificate to authenticate/authorize users for a subversion repository. That's my current server conf: What directives do I need to require a username?

<VirtualHost *:443>
    ServerAdmin  webmaster@localhost
    DocumentRoot /var/www
    ServerSignature On
    SSLEngine on
    SSLCertificateFile /opt/ssl/ServerCA/server/certs/ServerWeb.crt
    SSLCertificateKeyFile /opt/ssl/ServerCA/server/keys/ServerWeb.key
    SSLCACertificateFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLCertificateChainFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLVerifyClient optional
    SSLVerifyDepth 2

    <Location /repo>
        DAV svn
        SVNPath /srv/repos/svn/insec
        SSLRequireSSL
        AuthzSVNAccessFile /srv/repos/svn/insec/conf/authz
        AuthType Basic
        AuthName "Subversion repository"
        Require valid-user
    </Location>
</VirtualHost>

edit: added SSLCertificateChainFile so the client gets the ca cert if it is not already installed.
edit 2: So one last thing: how do I match a specific certificate to a username?

Improve this question
8
  • Umm..i maybe wrong here, but my understanding is that ssl doesn't require a username. Is username a seperate requirement for you here?
    – Software Mechanic
    May 15, 2011 at 12:08
  • Yes, it is, but i need it so that commits to the repo are associated with a username, otherwise they appear as from "no user".
    – icefex
    May 15, 2011 at 12:13
  • Ah that is more on svn configuration. will refresh my memory and get back...
    – Software Mechanic
    May 15, 2011 at 12:40
  • Just for reference, i used this guide: stylesen.org/… on a turnkey linux appliance.
    – icefex
    May 15, 2011 at 12:43
  • Tell me this how are the users executing the commit?? There are 2 levels of authentication involved (apache and svn). what is your svn configuration?
    – Software Mechanic
    May 15, 2011 at 13:06

1 Answer 1

Reset to default
2

Okay, I got it working now, for further reference here my conf:

<VirtualHost *:443>
    ServerAdmin  webmaster@localhost
    DocumentRoot /var/www
    ServerSignature On
    SSLEngine on
    SSLCertificateFile /opt/ssl/ServerCA/server/certs/ServerWeb.crt
    SSLCertificateKeyFile /opt/ssl/ServerCA/server/keys/ServerWeb.key
    SSLCACertificateFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLCertificateChainFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLVerifyClient optional
    SSLVerifyDepth 2
    SSLUserName SSL_CLIENT_S_DN_CN # that line tells apache to use the common name of the client certificate as the username, that's what i was still missing.

    <Location /repo>
        DAV svn
        SVNPath /path/to/repo/
        SSLRequireSSL
        AuthzSVNAccessFile /path/to/repo/conf/authz
    </Location>
</VirtualHost>
Improve this answer
2
  • Just out of curiousity, can you describe how your application works? It seems you provide repository access via apache(and therefore browser). Was wondering if it is just files storage(addition/deletion) or document editing too??
    – Software Mechanic
    May 16, 2011 at 9:38
  • I don't understand what exactly you mean but it is your usual svn over https setup just with certificates and not with user/pass.
    – icefex
    May 16, 2011 at 13:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .