2

I'm running an apache instance on a local server and wan't to require a username plus a corresponding certificate to authenticate/authorize users for a subversion repository. That's my current server conf: What directives do I need to require a username?

<VirtualHost *:443>
    ServerAdmin  webmaster@localhost
    DocumentRoot /var/www
    ServerSignature On
    SSLEngine on
    SSLCertificateFile /opt/ssl/ServerCA/server/certs/ServerWeb.crt
    SSLCertificateKeyFile /opt/ssl/ServerCA/server/keys/ServerWeb.key
    SSLCACertificateFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLCertificateChainFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLVerifyClient optional
    SSLVerifyDepth 2

    <Location /repo>
        DAV svn
        SVNPath /srv/repos/svn/insec
        SSLRequireSSL
        AuthzSVNAccessFile /srv/repos/svn/insec/conf/authz
        AuthType Basic
        AuthName "Subversion repository"
        Require valid-user
    </Location>
</VirtualHost>

edit: added SSLCertificateChainFile so the client gets the ca cert if it is not already installed.
edit 2: So one last thing: how do I match a specific certificate to a username?

Improve this question
8
  • Umm..i maybe wrong here, but my understanding is that ssl doesn't require a username. Is username a seperate requirement for you here? – Nandhini Anand Jeyahar May 15 '11 at 12:08
  • Yes, it is, but i need it so that commits to the repo are associated with a username, otherwise they appear as from "no user". – icefex May 15 '11 at 12:13
  • Ah that is more on svn configuration. will refresh my memory and get back... – Nandhini Anand Jeyahar May 15 '11 at 12:40
  • Just for reference, i used this guide: stylesen.org/… on a turnkey linux appliance. – icefex May 15 '11 at 12:43
  • Tell me this how are the users executing the commit?? There are 2 levels of authentication involved (apache and svn). what is your svn configuration? – Nandhini Anand Jeyahar May 15 '11 at 13:06
2

Okay, I got it working now, for further reference here my conf:

<VirtualHost *:443>
    ServerAdmin  webmaster@localhost
    DocumentRoot /var/www
    ServerSignature On
    SSLEngine on
    SSLCertificateFile /opt/ssl/ServerCA/server/certs/ServerWeb.crt
    SSLCertificateKeyFile /opt/ssl/ServerCA/server/keys/ServerWeb.key
    SSLCACertificateFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLCertificateChainFile /opt/ssl/ServerCA/CA/ServerCA.crt
    SSLVerifyClient optional
    SSLVerifyDepth 2
    SSLUserName SSL_CLIENT_S_DN_CN # that line tells apache to use the common name of the client certificate as the username, that's what i was still missing.

    <Location /repo>
        DAV svn
        SVNPath /path/to/repo/
        SSLRequireSSL
        AuthzSVNAccessFile /path/to/repo/conf/authz
    </Location>
</VirtualHost>
Improve this answer
2
  • Just out of curiousity, can you describe how your application works? It seems you provide repository access via apache(and therefore browser). Was wondering if it is just files storage(addition/deletion) or document editing too?? – Nandhini Anand Jeyahar May 16 '11 at 9:38
  • I don't understand what exactly you mean but it is your usual svn over https setup just with certificates and not with user/pass. – icefex May 16 '11 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.