0

I'm about to install a Visual SVN server on a live windows 2008 server so I can get to my code base from anywhere. I'm wondering if it would be better for me to install the server using Subversion authentication or if it would be better to install it with Windows authentication.

What are the pros and cons of each approach?

Improve this question

5 Answers 5

Reset to default
4

The tradeoff is really ease of administration and integration with your corporate security vs. the need for every user to have an Active Directory user account. AD accounts equals licenses, so cost might be a consideration.

If you are a corporate user and tha majority of your users will already have AD accounts, then this might be the best choice for you. You can implement role-based permissions using AD security groups, rather than managing individual users within VisualSVN. If you have a lot of users, this can greatly ease your admin burden.

On the other hand, if you don't want to pay for Client Access Licenses, if a significant proportion of your developers are outside your organisation, if you;re a hobbyist of if your development team is relatively small, then the lightweight Subversion authentication fits hand-in-glove.

I have chosen the SVN authentication, even though I already have all the Active Directory infrastructure, because my development group is a collaborative voluntary venture and the SVN authentication is really easy to set up and use. The only down side I've found is that the users can't set their own passwords. It is a shame that SVN doesn;t support both in parallel - like SQL Server does.

Improve this answer
2
  • 1
    +1 though handling passwords in a separate system for users, and especially SVN in my opinion, really makes the use of passwords/authentication almost moot (sadly)... as people will not normally change passwords in all systems unless they're forced - leaving it with stale passwords and probably handed-out passwords that anyone can guess...
    – Oskar Duveborn
    May 9, 2009 at 18:48
  • That is certainly one of the compelling reasons to use Active Directory authentication. Windows can be set to enforce password policies and the user's one password applies to everything in the Windows domain (single sign-on) including VisualSVN. Password proliferation is one of the main reasons users don't change their passwords.
    – Tim Long
    May 10, 2009 at 11:25
1

In going with Windows authentication, the first pro I can think of would be that I would only have to enter my user base one time.

However, as a con, it would also mean that I would have to have my users be windows users in order to authenticate into Subversion. If I only want them to use Subversion, that might present a security risk to me.

Improve this answer
1
  • The two are not mutually exclusive. Active Directory is quite capable of supporting user accounts that have no permissions to log in to any windows host. Group policy gives even more flexibility. For example, the InetOrgPerson record is often used in this situation, i.e. to create users who can authenticate but have no logon rights. "The InetOrgPerson objects are based on the standard defined in Internet RFC 2798, and are provided primarily for interoperability with third-party systems." This is typically used to provide mailboxes for external users, but it probably works for VisualSVN too.
    – Tim Long
    May 5, 2010 at 22:07
1

In going with Subversion authentication, a pro would be that I will be able to have a strict list of users that will only be able to have access to Subversion and not to my windows system.

However, as a con, any user that I wish to have Subversion access AND Windows access I will have to duplicate.

Improve this answer
2
  • Which is a violation of the DRY principle ^^
    – Oskar Duveborn
    May 9, 2009 at 18:46
  • 1
    The two are not mutually exclusive. Active Directory is quite capable of supporting user accounts that have no permissions to log in to any windows host. Group policy gives even more flexibility. For example, the InetOrgPerson record is often used in this situation, i.e. to create users who can authenticate but have no logon rights. "The InetOrgPerson objects are based on the standard defined in Internet RFC 2798, and are provided primarily for interoperability with third-party systems." This is typically used to provide mailboxes for external users, but it probably works for VisualSVN too.
    – Tim Long
    May 5, 2010 at 22:09
1

You can easily create new users for VisualSVN, without compromising security. I would give people separate account details for Subversion and Windows if security is a priority.

Improve this answer
1
  • Thanks, I'm kind of leaning that way at this point. I just wanted to know what the SF community thought about this as well.
    – Joseph
    May 7, 2009 at 23:50
0

From the official VisualSVN Server article:

Generally spoken, Integrated Windows Authentication is the best option for enterprise environments based on Windows. You can also use Basic authentication if you are forced to support legacy Subversion clients. Consider Subversion authentication if you do not have Active Directory Domain.

Find more details at http://www.visualsvn.com/support/topic/00039/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .