I have an SVN 1.6 server running on a Windows Server 2003 machine, served via CollabNet's svnserve running as a service (using the svn protocol). I would like to avoid storing passwords in plain text on the server. Unfortunately, the default configuration and SASL with DIGEST-MD5 both require plain text password storage.

What is the simplest possible way to avoid storing passwords in plain text?

My constraints are:

  • Path-based access control to the SVN repository needs to be possible (currently I can use an authz file). As far as I know, this is more-or-less independent of the authentication method.
  • Active directory is available, but it's not just domain-connected windows machines that need to authenticate: workgroup PCs, Linux PCs and software that uses PySVN to perform SVN operations all need to be able to access the repositories.

Upgrading the SVN server is feasible, as is installing additional software.

  • 1
    What method are you using to serve the repository? – Shane Madden Jun 19 '12 at 1:36
  • 2
    We use LDAP against our AD, and just as long as there's an AD account for the users, you just authenticate using your AD credentials by typing them in by hand (standard HTTP authentication). Is that an option? – Mark Henderson Jun 19 '12 at 1:39
  • @ShaneMadden - I think my update answers your question. – detly Jun 19 '12 at 2:47
  • @MarkHenderson - I tried using VisualSVN's AD integration, but couldn't find a way to make it work with non-domain-joined PCs. I'll look into whether LDAP is an option. Having said that, if there's a simpler way than that, I'd prefer it :) – detly Jun 19 '12 at 2:48

We use Collabnet's free SVN offering installed on an old Windows 2003 server with LDAP and HTTPS. We've never had any issues from domain and non-domain computers. The authentication just works; but I've also done this with SVN being accessed via Apache on Linux machines.

Regular HTTP access:

enter image description here

Apache config:

LoadModule dav_module         modules/mod_dav.so
LoadModule dav_svn_module     modules/mod_dav_svn.so
LoadModule authnz_ldap_module   modules/mod_authnz_ldap.so
LoadModule ldap_module      modules/mod_ldap.so

<Location /SVN/>
   DAV svn
   SVNParentPath D:\SVN

   AuthName "Subversion Repositories"
   AuthType Basic   
   AuthBasicProvider ldap
   AuthzLDAPAuthoritative on

   AuthLDAPURL "ldap://domain.local:3268/DC=domain,DC=local?sAMAccountName?sub?(objectClass=*)" NONE
   AuthLDAPBindDN username@domain.local
   AuthLDAPBindPassword password

   require valid-user
  • What about on the SVN side — does Apache launch the server process as needed, or does svnserve need to run as well? Does anything special need to go in svnserve.conf? – detly Jun 19 '12 at 3:18
  • svnserve still runs, but I have never touched its configuration past what it was installed with by default. – Mark Henderson Jun 19 '12 at 3:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.