Skip to main content

problem using subversion (svn) with Apache http server and LDAP

My users decided to move from CVS to SVN, and they want to use centralized LDAP server for user authentication, I need to setup a test server for prove of concept test.
I found one no longer used server, and installed SVN packages as well as mod_dav_svn. The Apache HTTP server is already there.
After I configured Apache HTTP follow the document at http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.prereqs , I tried to use subversion client to connect to it but failed. I checked http server log and found the request was sent to the wrong place:

# more error_log
......
[Wed May xx 16:07:36 2012] [error] [client 192.168.128.10] File does not exist: /var/www/html/repos
[Wed May xx 16:07:36 2012] [error] [client 192.168.128.10] File does not exist: /var/www/html/favicon.ico
[Wed May xx 16:07:49 2012] [error] [client 192.168.128.10] File does not exist: /var/www/html/repos
[Wed May xx 16:07:49 2012] [error] [client 192.168.128.10] File does not exist: /var/www/html/favicon.ico
............

and according to my configuration file, it should not go to /var/www/html/repos:

 # more /etc/httpd/conf.d/subversion.conf
LoadModule dav_svn_module     modules/mod_dav_svn.so
LoadModule authz_svn_module   modules/mod_authz_svn.so
<Location /repos>
        DAV svn
        SVNParentPath /var/www/svn
        AuthType Basic
        AuthName "xxxx SVN"
        AuthBasicProvider  ldap
        AuthLDAPURL "ldap://xxxxxx:389/ou=users,dc=xxxxxx,dc=com?uid?sub?(objectClass=*)"
        AuthzSVNAccessFile  /var/www/svn/access
        Require valid-user
</Location>

and any access to the URL should prompt for authentication but it didn't

had no clue after checked all the log files and tried different client, I started to think maybe the problem is Apache didn't read my configuration file. So I did a trace

# cd /tmp
# service httpd stop
# strace -o httpd.trace -f /usr/sbin/httpd  #####  to trace every system call from httpd
# grep "open" httpd.trace | grep "conf.d"    ##### to find out which file was read in conf.d directory
http.trace:open("/etc/httpd/conf.d/php.conf", O_RDONLY) = 4
http.trace:open("/etc/httpd/conf.d/php.conf", O_RDONLY) = 5

apparently, apache only load php.conf

so I looked into the main configuration file for the "include" directives:

# grep -i "include" /etc/httpd/conf/httpd.conf
LoadModule include_module modules/mod_include.so
Include conf.d/php.conf               ##### <<<------ here's the probem

I changed the line to

Include conf.d/*.conf 

and restart httpd server. Now when I access the URL http://servername/repos, my browser will prompt for username and password

to my surprise, if I exclude

AuthzSVNAccessFile  /var/www/svn/access

in /etc/httpd/conf.d/subversion.conf, I can have full access using any LDAP accounts, but if I include it, none of my account work (all of them will have access denied). the file  /var/www/svn/access looks like below:

# more /var/www/svn/access
[aliases]
test1= uid=test1,ou=users,dc=xxxx,dc=com
test2 = uid=test2,ou=users,dc=xxxx,dc=com

[groups]
dev= &test1, &test2

[projectA:/]
* = r
&test1 = rw

[projectB:/]
&test1 = r
@dev = rw

I made this file following the instructions at http://svnbook.red-bean.com/nightly/en/svn.serverconfig.pathbasedauthz.html. After a few test, it turned out the "&" is the problem,  somehow you don't need that,  after I changed the file to

# more /var/www/svn/access
[aliases]
test1= uid=test1,ou=is_team,ou=users,dc=xxxx,dc=com
test2 = uid=test2,ou=dev_team,ou=users,dc=xxxx,dc=com

[groups]
dev= test1, test2

[projectA:/]
* = r
test1 = rw

[projectB:/]
test1 = r
@dev = rw

everything works like expected.

my environment:

httpd-2.2.3-63.el5_8.1
mod_dav_svn-1.6.11-10.el5_8
subversion-1.6.11-10.el5_8

Comments

Popular posts from this blog

enable special character support in Graphite metric name

Problem Graphite doesn’t support special characters like “ “ (empty space), “/” slash etc. Because it expect everything to be just ASCII to split/processing them, and then make directories based on metric name. For example:   Metric:     datacenter1.server1.app1.metric1.abc Will create datacenter1/server1/app1/metric1/abc.wsp But Metric: datacentter1.this is a test/with/path.app.test will fail when create directory So any special name not allow to appear in directory/file name is not supported by Graphite.   What we can do?   We can urlEncode the metric name which has special characters. So like “/var/opt” (not valid file name) will become “%2Fvar%2Fopt”(now valid), using urlEncode instead of others (like BASE64) is because this will keep most of data readable.   So what to change? 1. urlEncode metric name before send to Graphite (if you always sending metrics using text/line mode instead of pickle/batch mode, then you may consider modify Carbon-cache.py), like     metricname=

How to send command / input to multiple Putty window simultaneously

Putty is one of the best and must-have freeware for people working on Linux/Unix but use Windows as client like me.  We need to manage many servers and sometimes we are hoping we can run/execute same command on multiple host at same time, or just input same thing to multiple host. I searched online for a tool can do this. And it looks like PuTTYCS (PuTTY Command Sender) is the only one existing. But I’m a little bit disappointing after tried the software, it’s good but not good enough. It can only send command to each window one by one, and you have to wait until last window got input. So I think I should do something, and puttyCluster was born ( https://github.com/mingbowan/puttyCluster ) interface is simple: When you input Windows title pattern in the text box, you will be prompt for how many windows matching the pattern, like this: and you click the edit box under “cluster input”, what ever key you pressed will pass to all those windows simultaneously, even “Ctrl-C”, “Esc” and