I am having a few problems getting SVN authentication to work with LDAP / Active Directory. My SVN installation works fine, but after enabling LDAP in my apache vhost, I just can't get my users to authenticate.

I can use a selection of LDAP browsers to successfully connect to Active Directory, but just can't seem to get this to work.

  • SVN is setup in /var/local/svn
  • Server is svn.domain.local
  • For testing, my repository is /var/local/svn/test

My vhost file is as follows:

<VirtualHost *:80>
        ServerAdmin alex@domain.com
        ServerAlias svn.domain.local
        ServerName svn.domain.local
        DocumentRoot /var/www/svn/

        <Location /test>
                DAV svn
                #SVNListParentPath On
                SVNPath /var/local/svn/test
                AuthzSVNAccessFile /var/local/svn/svnaccess
                AuthzLDAPAuthoritative off
                AuthType Basic
                AuthName "SVN Server"
                AuthBasicProvider ldap
                AuthLDAPBindDN "CN=adminuser,OU=SBSAdmin Users,OU=Users,OU=MyBusiness,DC=domain,DC=local"
                AuthLDAPBindPassword "admin password"
                AuthLDAPURL "ldap://,OU=Users,OU=MyBusiness,DC=domain,DC=local?sAMAccountName?sub?(objectClass=*)"
                Require valid-user

        CustomLog /var/log/apache2/svn/access.log combined
        ErrorLog /var/log/apache2/svn/error.log

In my error.log, I don't seem to get any bind errors (should I be looking elsewhere?), but just the following:

[Thu Jun 21 09:51:38 2012] [error] [client] user alex: authentication failure for "/test/": Password Mismatch, referer: http://svn.domain.local/test/

At the end of "AuthLDAPURL", I have seen people using TLS and NONE but neither seem to help in my case.

I have the ldap modules loaded and have checked as much as I know, so any help would be most welcome. Thanks


Set REFERRALS off in the server /etc/ldap/ldap.conf and try again.

And try adding "NONE" to the URL line:

AuthLDAPURL "ldap://,OU=Users,OU=MyBusiness,DC=domain,DC=local?sAMAccountName?sub?(objectClass=*)" NONE

Try ldapsearch. Do an .ldaprc in your home directory with this:

BASE DC=domain,DC=local
BINDDN CN=adminuser,OU=SBSAdmin Users,OU=Users,OU=MyBusiness,DC=domain,DC=local

Use it:

ldapsearch -D "CN=adminuser,OU=SBSAdmin Users,OU=Users,OU=MyBusiness,DC=domain,DC=local" -W sAMAccountName=user

It will ask for the BindDN password.

  • Afraid that doesn't seem to work. I get the same "authentication failure" messages in /var/log/apache2/svn/error.log - I'm certain that my password is correct, and my username is "alexh" and not "alexh@domain.local". Is there a way to get a more verbose output? – Alex Holsgrove Jun 21 '12 at 10:10
  • 1
    Would I be able to use this ldapsearch tool to confirm that I can connect? I've struggled to understand what parameters to pass to it. – Alex Holsgrove Jun 21 '12 at 10:11
  • I've updated the solution with information about ldapsearch. – Diego Fernández Durán Jun 21 '12 at 10:22
  • Thanks Diego. I created the .ldaprc file in /home/user and then ran the ldapsearch. It gave me: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1). I also tried this command and it seemed to work: ldapsearch -x -b "dc=domain,dc=local" -D "domain\adminuser" -h -p 389 -W - does that tell you anything? – Alex Holsgrove Jun 21 '12 at 10:25
  • OK, I made changes to my /etc/ldap/ldap.conf file and ran ldapsearch -x and it gave a bind error (LDAPv3) - error was "In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1" – Alex Holsgrove Jun 21 '12 at 10:42

Diego gets the points as it finally led me to get it working. It may have been a case of changing the order of the params in my virtualhost, but this is what worked for me. I also copied the admin user DN directly from an LDAP GUI tool to ensure I had the correct bind details:

<VirtualHost *:80>
        ServerAdmin admin@domain.com
        ServerAlias svn.domain.local
        ServerName svn.domain.local
        DocumentRoot /var/www/svn/

        <Location />
                DAV svn
                SVNParentPath /var/local/svn/
                SVNListParentPath On
                AuthBasicProvider ldap
                AuthType Basic
                AuthzLDAPAuthoritative off
                AuthName "SVN Server"
                AuthLDAPURL "ldap://,DC=local?sAMAccountName?sub?(objectClass=*)" NONE
                AUTHLDAPBindDN "CN=admin,OU=Admin Users,OU=Users,OU=MyBusiness,DC=domain,DC=local"
                AuthLDAPBindPassword ######
                require valid-user

Hope that helps someone else out!


It may not directly answer your question, but did you consider to use Subversion Edge? It is free to use (AGPLv3 license).

As you can see in this screenshot it is quite simple to setup LDAP integration. You can even install the SSPI module though this requires some manual work.

  • Thanks Stefan, I'm open to alternatives, and I will give Subversion Edge a go. I'd still like to find an answer to my specific problem as well, as I have seen others with similar problems. Thanks again – Alex Holsgrove Jul 2 '12 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.