You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Denis SAGET <ge...@free.fr> on 2007/05/24 15:19:12 UTC
per directory access control issue on multiple repository with Apache
Hello, I'm having trouble with fine grain permissions on a Per-Directory
Access Control and multiple subversion repositories under apache.
I use subversion-1.4.3_2, neon-0.26.3, apache-2.0.59, db4-4.0.14_1,1
under FreeBSD 5.5-STABLE on a standard PC. The URLs looks like
https://svn.domain.com/myrepo or https://svn.domain.com/otherrepo. The
server runs fine since 2 years, I don't have any problem with multiple
repos. Today, I must give read/write acces to some users and no access
to everybody on a subdirectory of one repository.
I must give everybody read access (comment the line like "#*=" or give
"*=r" to the subdir repo in authz file) to give the write permission for
authenticated users to a subdirectory [myrepo:/myrepo-coreV1] in this
repository. If I don't give everybody read permission, only the admin
group can read/write anything. All other rules in each subdir inside
"myrepo" and the "otherrepo" work great.
Some apache logs
[Thu May 24 14:24:25 2007] [error] [client 10.0.0.112] Access denied: -
GET myrepo:/myrepo-coreV1, referer: https://svn.domain.com/myrepo/
I noticed that you cannot use the "LimitExcept" directive if there is
"*=" in the authz file for one repository. Is it documented somewhere.
Here are the elements of the config:
Apache:
=======
<Location /myrepo>
DAV svn
SVNPath /home/www/domain.com/svn/repos/myrepo
AuthzSVNAccessFile /home/www/domain.com/svn/conf/global_authz
Satisfy Any
# Limit write permission to list of valid users.
<LimitExcept GET PROPFIND OPTIONS REPORT>
Require valid-user
AuthType Basic
AuthName "Subversion myrepo Repositories"
AuthUserFile /home/www/domain.com/svn/conf/svn_users
</LimitExcept>
</Location>
<Location /otherrepo>
DAV svn
SVNPath /home/www/domain.com/svn/repos/otherrepo
AuthzSVNAccessFile /home/www/domain.com/svn/conf/global_authz
Require valid-user
AuthType Basic
AuthName "Subversion otherrepo Repositories"
AuthUserFile /home/www/domain.com/svn/conf/svn_users
</Location>
global_authz:
=============
[groups]
admin = myusername
myrepocontrib = user1, user2, user3
myrepoV1contrib = user1, user2
otherrepo = user1, user4, user5
[/]
@admin = rw
* =
[myrepo:/]
@admin = rw
@myrepocontrib = rw
* = r
[rmyrepo:/myrepo-core/taglib]
@admin = rw
@myrepocontrib = rw
user4 = rw
* = r
[myrepo:/myrepo-coreV1]
@admin = rw
@myrepoV1contrib = rw
#* =
[otherrepo:/]
@admin = rw
@otherrepo = rw
* =
Does anybody get some idea where I would have make a mistake or
something else ? I search on the Internet for a long time but I did not
find anything to explain it.
Thanks for any help.
Geodni
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Subversion on a Parabuild remote builder.
Posted by Karl Fogel <kf...@red-bean.com>.
Hi, Mark. I don't have an answer to your question, but I do have a
suggestion for future posts: please read this
http://subversion.tigris.org/mailing-list-guidelines.html#fresh-post
...for an explanation of why following up to an unrelated list mail to
make a new post is a bad idea. (No big deal, just letting you know
for next time.)
Thanks,
-Karl
"Mark Coleman" <Ma...@tomtom.com> writes:
> I am currently trying to run a BASH script on a remote Parabuild server.
>
> For some reason svn checkout, add and stat work fine, but commit hangs
> and never returns anything.
>
> The commit works fine when I run the script manually in a BASH shell on
> the machine in question, so it must be something to do with the account
> that the Parabuild service is running on.
>
> I realise that this is more of a Parabuild question, but I wanted to
> find out what could be the possible causes of a commit hang from a
> Subversion point of view.
>
> Any help with this is greatly appreciated.
>
> Kind regards,
>
> Mark Coleman | Software Developer | TomTom | mark.coleman@tomtom.com |
> +31 (0)20 8500955 office
>
>
>
> -----Original Message-----
> From: Denis SAGET [mailto:geodni@free.fr]
> Sent: Friday, May 25, 2007 10:23 AM
> To: Andy Levy
> Cc: users@subversion.tigris.org
> Subject: Re: per directory access control issue on multiple repository
> with Apache
>
>
>
> Andy Levy wrote:
>> On 5/24/07, Denis SAGET <ge...@free.fr> wrote:
>>> global_authz:
>>> =============
>>>
>>> [groups]
>>> admin = myusername
>>> myrepocontrib = user1, user2, user3
>>> myrepoV1contrib = user1, user2
>>> otherrepo = user1, user4, user5
>>>
>>> [/]
>>> @admin = rw
>>> * =
>>>
>>> [myrepo:/]
>>> @admin = rw
>>> @myrepocontrib = rw
>>> * = r
>>>
>>> [rmyrepo:/myrepo-core/taglib]
>>> @admin = rw
>>> @myrepocontrib = rw
>>> user4 = rw
>>> * = r
>>>
>>> [myrepo:/myrepo-coreV1]
>>> @admin = rw
>>> @myrepoV1contrib = rw
>>> #* =
>>>
>>> [otherrepo:/]
>>> @admin = rw
>>> @otherrepo = rw
>>> * =
>>
>> Reverse the order of these - put the * = lines FIRST, then the other
>> settings after. IIRC, you're saying "give these groups RW access -
>> then remove access for everyone."
> I tried with this order in the authz file
> [myrepo:/myrepo-coreV1]
> * =
> @myrepoV1contrib = rw
> @admin = rw
>
> It does change anything I still have "Access denied: - GET
> myrepo:/myrepo-coreV1 and no authentication is prompted for anybody.
> Thanks
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
>
>
> This e-mail message contains information which is confidential and may be privileged. It is intended for use by the addressee only. If you are not the intended addressee, we request that you notify the sender immediately and delete or destroy this e-mail message and any attachment(s), without copying, saving, forwarding, disclosing or using its contents in any other way. TomTom N.V., TomTom International BV or any other company belonging to the TomTom group of companies will not be liable for damage relating to the communication by e-mail of data, documents or any other information.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Subversion on a Parabuild remote builder.
Posted by Mark Coleman <Ma...@tomtom.com>.
Hello,
I am currently trying to run a BASH script on a remote Parabuild server.
For some reason svn checkout, add and stat work fine, but commit hangs
and never returns anything.
The commit works fine when I run the script manually in a BASH shell on
the machine in question, so it must be something to do with the account
that the Parabuild service is running on.
I realise that this is more of a Parabuild question, but I wanted to
find out what could be the possible causes of a commit hang from a
Subversion point of view.
Any help with this is greatly appreciated.
Kind regards,
Mark Coleman | Software Developer | TomTom | mark.coleman@tomtom.com |
+31 (0)20 8500955 office
-----Original Message-----
From: Denis SAGET [mailto:geodni@free.fr]
Sent: Friday, May 25, 2007 10:23 AM
To: Andy Levy
Cc: users@subversion.tigris.org
Subject: Re: per directory access control issue on multiple repository
with Apache
Andy Levy wrote:
> On 5/24/07, Denis SAGET <ge...@free.fr> wrote:
>> global_authz:
>> =============
>>
>> [groups]
>> admin = myusername
>> myrepocontrib = user1, user2, user3
>> myrepoV1contrib = user1, user2
>> otherrepo = user1, user4, user5
>>
>> [/]
>> @admin = rw
>> * =
>>
>> [myrepo:/]
>> @admin = rw
>> @myrepocontrib = rw
>> * = r
>>
>> [rmyrepo:/myrepo-core/taglib]
>> @admin = rw
>> @myrepocontrib = rw
>> user4 = rw
>> * = r
>>
>> [myrepo:/myrepo-coreV1]
>> @admin = rw
>> @myrepoV1contrib = rw
>> #* =
>>
>> [otherrepo:/]
>> @admin = rw
>> @otherrepo = rw
>> * =
>
> Reverse the order of these - put the * = lines FIRST, then the other
> settings after. IIRC, you're saying "give these groups RW access -
> then remove access for everyone."
I tried with this order in the authz file
[myrepo:/myrepo-coreV1]
* =
@myrepoV1contrib = rw
@admin = rw
It does change anything I still have "Access denied: - GET
myrepo:/myrepo-coreV1 and no authentication is prompted for anybody.
Thanks
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
This e-mail message contains information which is confidential and may be privileged. It is intended for use by the addressee only. If you are not the intended addressee, we request that you notify the sender immediately and delete or destroy this e-mail message and any attachment(s), without copying, saving, forwarding, disclosing or using its contents in any other way. TomTom N.V., TomTom International BV or any other company belonging to the TomTom group of companies will not be liable for damage relating to the communication by e-mail of data, documents or any other information.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: per directory access control issue on multiple repository with
Apache
Posted by Denis SAGET <ge...@free.fr>.
Andy Levy wrote:
> On 5/24/07, Denis SAGET <ge...@free.fr> wrote:
>> global_authz:
>> =============
>>
>> [groups]
>> admin = myusername
>> myrepocontrib = user1, user2, user3
>> myrepoV1contrib = user1, user2
>> otherrepo = user1, user4, user5
>>
>> [/]
>> @admin = rw
>> * =
>>
>> [myrepo:/]
>> @admin = rw
>> @myrepocontrib = rw
>> * = r
>>
>> [rmyrepo:/myrepo-core/taglib]
>> @admin = rw
>> @myrepocontrib = rw
>> user4 = rw
>> * = r
>>
>> [myrepo:/myrepo-coreV1]
>> @admin = rw
>> @myrepoV1contrib = rw
>> #* =
>>
>> [otherrepo:/]
>> @admin = rw
>> @otherrepo = rw
>> * =
>
> Reverse the order of these - put the * = lines FIRST, then the other
> settings after. IIRC, you're saying "give these groups RW access -
> then remove access for everyone."
I tried with this order in the authz file
[myrepo:/myrepo-coreV1]
* =
@myrepoV1contrib = rw
@admin = rw
It does change anything I still have "Access denied: - GET
myrepo:/myrepo-coreV1 and no authentication is prompted for anybody.
Thanks
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: per directory access control issue on multiple repository with Apache
Posted by Andy Levy <an...@gmail.com>.
On 5/24/07, Denis SAGET <ge...@free.fr> wrote:
> global_authz:
> =============
>
> [groups]
> admin = myusername
> myrepocontrib = user1, user2, user3
> myrepoV1contrib = user1, user2
> otherrepo = user1, user4, user5
>
> [/]
> @admin = rw
> * =
>
> [myrepo:/]
> @admin = rw
> @myrepocontrib = rw
> * = r
>
> [rmyrepo:/myrepo-core/taglib]
> @admin = rw
> @myrepocontrib = rw
> user4 = rw
> * = r
>
> [myrepo:/myrepo-coreV1]
> @admin = rw
> @myrepoV1contrib = rw
> #* =
>
> [otherrepo:/]
> @admin = rw
> @otherrepo = rw
> * =
Reverse the order of these - put the * = lines FIRST, then the other
settings after. IIRC, you're saying "give these groups RW access -
then remove access for everyone."
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org