Skip to main content

problem using subversion (svn) with Apache http server and LDAP

My users decided to move from CVS to SVN, and they want to use centralized LDAP server for user authentication, I need to setup a test server for prove of concept test.
I found one no longer used server, and installed SVN packages as well as mod_dav_svn. The Apache HTTP server is already there.
After I configured Apache HTTP follow the document at http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.prereqs , I tried to use subversion client to connect to it but failed. I checked http server log and found the request was sent to the wrong place:

# more error_log
......
[Wed May xx 16:07:36 2012] [error] [client 192.168.128.10] File does not exist: /var/www/html/repos
[Wed May xx 16:07:36 2012] [error] [client 192.168.128.10] File does not exist: /var/www/html/favicon.ico
[Wed May xx 16:07:49 2012] [error] [client 192.168.128.10] File does not exist: /var/www/html/repos
[Wed May xx 16:07:49 2012] [error] [client 192.168.128.10] File does not exist: /var/www/html/favicon.ico
............

and according to my configuration file, it should not go to /var/www/html/repos:

 # more /etc/httpd/conf.d/subversion.conf
LoadModule dav_svn_module     modules/mod_dav_svn.so
LoadModule authz_svn_module   modules/mod_authz_svn.so
<Location /repos>
        DAV svn
        SVNParentPath /var/www/svn
        AuthType Basic
        AuthName "xxxx SVN"
        AuthBasicProvider  ldap
        AuthLDAPURL "ldap://xxxxxx:389/ou=users,dc=xxxxxx,dc=com?uid?sub?(objectClass=*)"
        AuthzSVNAccessFile  /var/www/svn/access
        Require valid-user
</Location>

and any access to the URL should prompt for authentication but it didn't

had no clue after checked all the log files and tried different client, I started to think maybe the problem is Apache didn't read my configuration file. So I did a trace

# cd /tmp
# service httpd stop
# strace -o httpd.trace -f /usr/sbin/httpd  #####  to trace every system call from httpd
# grep "open" httpd.trace | grep "conf.d"    ##### to find out which file was read in conf.d directory
http.trace:open("/etc/httpd/conf.d/php.conf", O_RDONLY) = 4
http.trace:open("/etc/httpd/conf.d/php.conf", O_RDONLY) = 5

apparently, apache only load php.conf

so I looked into the main configuration file for the "include" directives:

# grep -i "include" /etc/httpd/conf/httpd.conf
LoadModule include_module modules/mod_include.so
Include conf.d/php.conf               ##### <<<------ here's the probem

I changed the line to

Include conf.d/*.conf 

and restart httpd server. Now when I access the URL http://servername/repos, my browser will prompt for username and password

to my surprise, if I exclude

AuthzSVNAccessFile  /var/www/svn/access

in /etc/httpd/conf.d/subversion.conf, I can have full access using any LDAP accounts, but if I include it, none of my account work (all of them will have access denied). the file  /var/www/svn/access looks like below:

# more /var/www/svn/access
[aliases]
test1= uid=test1,ou=users,dc=xxxx,dc=com
test2 = uid=test2,ou=users,dc=xxxx,dc=com

[groups]
dev= &test1, &test2

[projectA:/]
* = r
&test1 = rw

[projectB:/]
&test1 = r
@dev = rw

I made this file following the instructions at http://svnbook.red-bean.com/nightly/en/svn.serverconfig.pathbasedauthz.html. After a few test, it turned out the "&" is the problem,  somehow you don't need that,  after I changed the file to

# more /var/www/svn/access
[aliases]
test1= uid=test1,ou=is_team,ou=users,dc=xxxx,dc=com
test2 = uid=test2,ou=dev_team,ou=users,dc=xxxx,dc=com

[groups]
dev= test1, test2

[projectA:/]
* = r
test1 = rw

[projectB:/]
test1 = r
@dev = rw

everything works like expected.

my environment:

httpd-2.2.3-63.el5_8.1
mod_dav_svn-1.6.11-10.el5_8
subversion-1.6.11-10.el5_8

Comments

Post a Comment

Popular posts from this blog

enable special character support in Graphite metric name

Problem Graphite doesn’t support special characters like “ “ (empty space), “/” slash etc. Because it expect everything to be just ASCII to split/processing them, and then make directories based on metric name. For example:   Metric:     datacenter1.server1.app1.metric1.abc Will create datacenter1/server1/app1/metric1/abc.wsp But Metric: datacentter1.this is a test/with/path.app.test will fail when create directory So any special name not allow to appear in directory/file name is not supported by Graphite.   What we can do?   We can urlEncode the metric name which has special characters. So like “/var/opt” (not valid file name) will become “%2Fvar%2Fopt”(now valid), using urlEncode instead of others (like BASE64) is because this will keep most of data readable.   So what to change? 1. urlEncode metric name before send to Graphite (if you always sending metrics using text/line mode instead of pickle/batch mode, then you may consider modify ...
2 comments
Read more

How to send command / input to multiple Putty window simultaneously

Putty is one of the best and must-have freeware for people working on Linux/Unix but use Windows as client like me.  We need to manage many servers and sometimes we are hoping we can run/execute same command on multiple host at same time, or just input same thing to multiple host. I searched online for a tool can do this. And it looks like PuTTYCS (PuTTY Command Sender) is the only one existing. But I’m a little bit disappointing after tried the software, it’s good but not good enough. It can only send command to each window one by one, and you have to wait until last window got input. So I think I should do something, and puttyCluster was born ( https://github.com/mingbowan/puttyCluster ) interface is simple: When you input Windows title pattern in the text box, you will be prompt for how many windows matching the pattern, like this: and you click the edit box under “cluster input”, what ever key you pressed will pass to all those windows simultaneously, even “Ctrl-C”, “Esc” ...
2 comments
Read more

troubleshooting: gimp 2.8 cannot start up plugin

gimp 2.8 is out, I downloaded Windows version and installed. But when I try to run it, below error pops-up (the procedure entry point gzdirect could not be located in the dynamic link library zlib1.dll):   if I click on OK, the program can continue, but I want to fix it since I don’t want to miss anything, so I fired up Process explore and when the error pops-up, I located the zlib1.dll using Process Explorer’s DDL view   Here’s the output double click on zlib1.dll, and got below info   I did a file search under GIMP’s directory, there are 2 of them (one for 64-bit and one for 32-bit), and the version is different with the one in Windows directory:   seems the dll file within system directory was loaded instead of the one come with Gimp. I located the plugin’s directory by double click on the name (script-fu.exe) in Process Explorer And then copied zlib1.dll from GIMP’s bin directory (in my case, its C:\Program Files\GIMP 2\bin ) into the plug-ins di...
1 comment
Read more