I have a single SVN repo at /var/svn/ with a few subdirectories. Staff must be able to access the top-level directory and all subdirectories within it, but I want to restrict access to subdirectories using alternate htpasswd files.

This works for our Staff.

<Location />
DAV svn
SVNParentPath /var/svn

AuthType Basic
AuthBasicProvider ldap

# mod_authnz_ldap
AuthzLDAPAuthoritative off
AuthLDAPURL "ldap.example.org:636/ou=people,ou=Unit,ou=Host,o=ldapsvc,dc=example,dc=org?uid?sub?(objectClass=PosixAccount)"
AuthLDAPGroupAttribute memberUid
AuthLDAPGroupAttributeIsDN off

Require ldap-group cn=staff,ou=PosixGroup,ou=Unit,ou=Host,o=ldapsvc,dc=example,dc=org

Now, I am trying to restrict access to a subdirectory with a separate htpasswd file, like this:

<Location /customerA>
DAV svn
SVNParentPath /var/svn

# mod_authn_file
AuthType Basic
AuthBasicProvider file
AuthUserFile /usr/local/etc/apache22/htpasswd.customerA
Require user customerA

I can use Firefox and curl to browse to this folder fine:

curl https://svn.example.org/customerA/ --user customerA:password

But I cannot use check out this SVN repository:

$ svn co https://svn.example.org/customerA/
svn: Repository moved permanently to 'https://svn.example.org/customerA/'; please relocate

And on the server logs, I get this strange error:

# httpd-access.log - - [03/May/2010:16:40:00 -0700] "OPTIONS /customerA HTTP/1.1" 401 401 - customerA [03/May/2010:16:40:00 -0700] "OPTIONS /customerA HTTP/1.1" 301 244

# httpd-error.log
[Mon May 03 16:40:00 2010] [error] [client] Could not fetch resource information.  [301, #0]
[Mon May 03 16:40:00 2010] [error] [client] Requests for a collection must have a trailing slash on the URI.  [301, #0]

My questions:

  1. Can I restrict access to Subversion subdirectories using Apache access controls? DocumentRoot is commented out, so it's not clear that the FAQ at http://subversion.apache.org/faq.html#http-301-error applies.
  2. I prefer to not use AuthzSVNAccessFile, because it doesn't support LDAP groups. We control access using LDAP, and make heavy use of LDAP groups.
  • I earned the Tumbleweed badge for this! – Stefan Lasiewski May 11 '10 at 20:08

I've just spent all afternoon trying to do it, and I think the answer to question 1 as you've asked it is "no". If I try it and look in the error log, I see errors on PROPFIND requests for paths like "/myrepo/!svn": i.e., I think the Subversion client is sometimes requesting magic paths that only have meaning to the Subversion server module, as opposed to paths like "/myrepo/subdir" that Apache could understand and restrict.

The fact that you're using SVNParentPath, however, makes me suspect that /var/svn actually contains multiple Subversion repositories, and customerA is one such repository. You can tell by checking if there is a file /var/svn/customerA/format.

Is that correct? If so, you can set up a VirtualHost or another location where you can access just the customerA repository using the SVNPath directive. For example:

  ServerName customerA.example.com

  <Location />
     SVNPath /var/svn/customerA

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.