I just set up an SVN server (on a Windows XP machine) for my lab at my university. Right now, anyone can access and commit to the repository anonymously.

I want to allow only certain users on our AD domain to be allowed to access the repository. If possible, I also want the passwords to be the same as the password for the domain.

Is this possible to do?


I installed mod_auth_sspi and configured my httpd.conf with the following:

DAV svn SVNPath "R:\SVN"

AuthName "SVN Server"
AuthType SSPI
SSPIAuthoritative On
SSPIOfferBasic On
Require valid-user

AuthzSVNAccessFile "r:/svn/svnaccess.conf"

and in svnaccess.conf:

dev = AD\user1, user1, AD\user2, user2

@dev = rw
  • +1 - great question. I did this the LDAP way a few years ago and was a real hassle finding all the right info. I'm glad ServerFault exists for these kinds of questions now! Feb 26 '10 at 2:23

If you are using Apache, yes. Make sure that mod_auth_sspi is installed. You then configure the directory with the appropriate settings:

<Directory />
    Options FollowSymLinks
    AllowOverride None

    AuthType SSPI
    AuthName "YOURDOMAIN"
    SSPIAuth On
    SSPIAuthoritative Off
    SSPIDomain dc.yourdomain.com
    SSPIOmitDomain Off
    SSPIOfferBasic On
    SSPIUsernameCase lower
    Require group "YOURDOMAIN\AuthorizedGroup" 

In your svnpasswd file you simply specify the users with full domain names

developers = mydomain\myuser
@developers = rw

I hope that helps a bit.

  • I had to change a few settings but this worked for me!
    – rlbond
    Mar 1 '10 at 18:02

You didn't explicitly state how Subversion is served, but based on your tags, I'm assuming Apache. Using Apache 2.2 to serve Subversion with authentication by AD is pretty simple.

In your Apache config, you need to add the appropriate Auth parameters to the location block for the repository.

For example (restricted read and write access):

<Location /repo>
    DAV svn
    SVNPath /var/svn/repo
    AuthName "Subversion WebDAV"
    AuthType Basic
    AuthLDAPURL "<ldap_url>"
    AuthLDAPBindDN "<ldap_bind_dn>"
    AuthLDAPBindPassword "<password>"
    Require valid-user

You may need to talk to you AD administrator to set up a service account for Apache to use to connect to AD (if your AD requires you to bind before performing a search).

If you wish to allow anonymous reads while requiring users to authenticate to write, replace the Require valid-user line above with the following:

    Require valid-user
  • In case someone else comes along here in the future and finds this, a bit more info: Your AuthLDAPURL should look like: ldap://<domaincontroller>.<domain>.<local>:389/DC=<domain>,DC=<local>?sAMAccountName?sub?(objectClass=*) (this example uses domain.local as your AD domain name, substitute where nessesary) Feb 26 '10 at 2:22

Two other options for hosting subversion repositories on Windows are SVNIsapi and Visual SVN.

SVNIsapi is an IIS plugin for IIS 6.0 and above. AD security is provided by IIS.

Visual SVN bundles apache, svn and a GUI tool to administer repositories. AD security is provided by an apache module, and is configured via the GUI tool.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.