When using Apache2 with client certificates and FakeBasicAuth, how do I refer to users in the AuthzSVNAccessFile? The usernames have funny characters, like /CN=Damon Wischik, and authz doesn't like the = character in usernames.

My Apache configuration has the lines

    SSLVerifyClient require
    SSLOptions +FakeBasicAuth

This means that the user provides a client certificate, Apache takes the subject line from the certificate e.g. /CN=Damon Wischik, and uses that as the username and "password" as the password. I've added an htpasswd entry for this user, and he can log on happily.

Now I want to add fine-grained access control to the repository, and I can't work out how to refer to this username in the AuthzSVNAccessFile. I started off with

* = r

and the user was able to read the contents of the repository. I tried writing

* =
"/CN=Damon Wischik" = r

and the user gets "Access forbidden", and the Apache error log says

[date] [error] [client ip] Failed to load the AuthzSVNAccessFile: The character 'D' in rule '"/CN' is not allowed in authz rules
[date] [error] [client ip] Access denied: '/CN=Damon Wischik' GET foo:/

What's the correct way to escape these funny characters in usernames, in the authz file?

  • This isn't my area of expertise, but generally speaking you'd escape a character by using a backslash before the character. – Jenny D Oct 8 '12 at 7:03
  • If I try username /CN\=Damon Wischik, I get the error message: "The character 'D' in rule '/CN\\' is not allowed in authz rules" – DamonJW Oct 8 '12 at 7:42

(Thanks to Stefan Sperling on the subversion-users mailing list for the answer.) RTFM! From the red bean book chapter 6,

Subversion 1.5 brought several useful features to the access file syntax—username aliases, authentication class tokens, and a new rule exclusion mechanism—all of which further simplify the maintenance of the access file.

Here is how to use aliases in this particular case.

djw = /CN=Damon Wischik

* = 
&djw = r

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.