You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Jim Sokoloff <ji...@sokoloff.com> on 2004/01/29 17:32:01 UTC
Re: 207 Multi-Status using mod_authz_svn
On Thu, 29 Jan 2004, Juanma Barranquero wrote:
> My conf/authz_svn:
>
> [groups]
> @commiters = Juanma, Jorge
> @owners = Lektu
When *defining* groups, don't use the @ sign.
--Jim
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: 207 Multi-Status using mod_authz_svn
Posted by Juanma Barranquero <jm...@wke.es>.
On Fri, 30 Jan 2004 07:34:59 -0600
Ben Collins-Sussman <su...@collab.net> wrote:
> Hm, I see two strange things here. First, I would expect to see
> "Juanma" fail on the PROPFIND because of authz failure, not because of a
> "password mismatch". (We're seeing Juanma here only because it's the
> cached credentials that the client tries first. When they fail, the
> client tries prompting the user instead.)
No mystery there: "svn ls" prompts me to introduce the password for
Juanma (no cached data, I'm using --no-auth-cache as shown in the
example), and I hit <RET> because I know Juanma's not gonna work. Then
it prompts me for Lektu and I enter the password, which "works": there's
no Apache error, so it doesn't show in the Apache log.
> Juanma, did you truncate the output here, or is that really the whole
> client error? 207 is not an error... I would expect the client to give
> more detail about the problem, say, if there's an internal error within
> the 207.
That's the full output of the svn.exe client.
> I suppose one of us should try to reproduce this situation, and see
> what's really happening in ethereal.
I could use ethereal, but I wouldn't know what to look for, so it's
better if someone tries to reproduce it. For one, that way we'll know if
it's really a bug or some weird local thing (which shouldn't, I have a
stock pre-built Windows binary for Apache 2.0.48 and the Brane-supplied
exes for Subversion 0.37.0).
Juanma
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: 207 Multi-Status using mod_authz_svn
Posted by Juanma Barranquero <jm...@wke.es>.
On Fri, 30 Jan 2004 15:31:56 +0100 Juanma Barranquero
<jm...@wke.es> wrote:
> These lines in httpd.conf:
>
> LoadModule deflate_module modules/mod_deflate.so
>
> <Location />
> AddOutputFilterByType DEFLATE text/html
> </Location>
I can bypass the problem with
BrowserMatch ^SVN/ no-gzip
but I'm still puzzled.
The client (svn.exe) sends the following headers:
PROPFIND /test/trunk HTTP/1.1
Host: localhost:80
User-Agent: SVN/0.37.0 (r8509) neon/0.24.4
Keep-Alive:
Connection: TE, Keep-Alive
TE: trailers
Content-Length: 300
Content-Type: text/xml
Depth: 0
Accept-Encoding: gzip
Accept-Encoding: gzip
(yes, "Accept-Encoding: gzip" appears twice), and the server is
answering the same in both cases:
HTTP/1.1 207 Multi-Status
Date: ...
Server: Apache/2.0.48
Cache-Control: max-age=0
Expires: ...
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: ...
Keep-Alive: ...
Connection: Keep-Alive
Content-Type: text/xml; charset="utf-8"
It is very puzzling that the client should fail when
AddOutputFilterByType DEFLATE text/html
is used, because:
- as seen above,the server is sending back text/xml
- I also have an AddOutputFilterByType DEFLATE text/xml, which doesn't
seem to interfere
- the <Location /svn> section has "SetOutputFilter DEFLATE", so all
output from /svn should be deflated anyway (and taking that
directive away does not seem to affect the issue)
So, is this a bug, and if so, filed at the issue tracker? Or not-a-bug,
and then perhaps a FAQ entry would be in order?
Thanks,
Juanma
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: 207 Multi-Status using mod_authz_svn
Posted by Juanma Barranquero <jm...@wke.es>.
On Fri, 30 Jan 2004 14:17:03 +0000
Joe Orton <jo...@manyfish.co.uk> wrote:
> The parsing of the 207 body is being done in ra_dav, so only ra_dav
> knows about any more specific errors from propstats in the response.
I found the culprit.
These lines in httpd.conf:
LoadModule deflate_module modules/mod_deflate.so
<Location />
AddOutputFilterByType DEFLATE text/html
</Location>
Whether that's a set up error or a problem with the client, I don't know.
Juanma
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: 207 Multi-Status using mod_authz_svn
Posted by Joe Orton <jo...@manyfish.co.uk>.
On Fri, Jan 30, 2004 at 07:34:59AM -0600, Ben Collins-Sussman wrote:
> Now, it's possible for a 207 to contain an error code *within* it, but
> we're not seeing that in neon's output:
>
> D:\> svn --no-auth-cache ls http://localhost/svn/trunk/conf
> Authentication realm: <http://localhost:80> Subversion
> Password for 'Juanma':
> Authentication realm: <http://localhost:80> Subversion
> Username: Lektu
> Password for 'Lektu': **********
> svn: PROPFIND request failed on '/svn/trunk/conf'
> svn: PROPFIND of '/svn/trunk/conf': 207 Multi-Status
> (http://localhost)
>
> Juanma, did you truncate the output here, or is that really the whole
> client error? 207 is not an error... I would expect the client to give
> more detail about the problem, say, if there's an internal error within
> the 207.
>
> Joe Orton, any opinions here?
If the request was dispatched succesfully (i.e. no HTTP protocol error),
then ne_get_error() will always just return the status-line like above.
The parsing of the 207 body is being done in ra_dav, so only ra_dav
knows about any more specific errors from propstats in the response.
joe
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: 207 Multi-Status using mod_authz_svn
Posted by Ben Collins-Sussman <su...@collab.net>.
On Fri, 2004-01-30 at 04:02, Juanma Barranquero wrote:
> - access.log:
> 127.0.0.1 - - [30/Jan/2004:10:47:38 +0100] "PROPFIND /svn/trunk/conf HTTP/1.1" 401 363
> 127.0.0.1 - Juanma [30/Jan/2004:10:47:38 +0100] "PROPFIND /svn/trunk/conf HTTP/1.1" 401 363
> 127.0.0.1 - Juanma [30/Jan/2004:10:47:39 +0100] "PROPFIND /svn/trunk/conf HTTP/1.1" 401 363
> 127.0.0.1 - Lektu [30/Jan/2004:10:47:46 +0100] "PROPFIND /svn/trunk/conf HTTP/1.1" 207 352
>
> - error.log:
> [Fri Jan 30 10:47:38 2004] [error] [client 127.0.0.1] Access denied: 'Juanma' PROPFIND /trunk/conf
> [Fri Jan 30 10:47:39 2004] [error] [client 127.0.0.1] user Juanma: authentication failure for "/svn/trunk/conf": Password Mismatch
Hm, I see two strange things here. First, I would expect to see
"Juanma" fail on the PROPFIND because of authz failure, not because of a
"password mismatch". (We're seeing Juanma here only because it's the
cached credentials that the client tries first. When they fail, the
client tries prompting the user instead.)
Second, I don't see *any* error at all with Lektu: no password
mismatch, no authz failures. In fact, it looks like Lektu's PROPFIND
authenticates and authorizes correctly -- we get back a 207 multi-status
response.
Now, it's possible for a 207 to contain an error code *within* it, but
we're not seeing that in neon's output:
D:\> svn --no-auth-cache ls http://localhost/svn/trunk/conf
Authentication realm: <http://localhost:80> Subversion
Password for 'Juanma':
Authentication realm: <http://localhost:80> Subversion
Username: Lektu
Password for 'Lektu': **********
svn: PROPFIND request failed on '/svn/trunk/conf'
svn: PROPFIND of '/svn/trunk/conf': 207 Multi-Status
(http://localhost)
Juanma, did you truncate the output here, or is that really the whole
client error? 207 is not an error... I would expect the client to give
more detail about the problem, say, if there's an internal error within
the 207.
Joe Orton, any opinions here?
I suppose one of us should try to reproduce this situation, and see
what's really happening in ethereal.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: 207 Multi-Status using mod_authz_svn
Posted by Juanma Barranquero <jm...@wke.es>.
On Fri, 30 Jan 2004 10:39:18 +0100 Juanma Barranquero
<jm...@wke.es> wrote:
> I can browse the repository with IE,
> but the client is unable to do an "ls".
With "svn ls", the Apache logs are:
- access.log:
127.0.0.1 - - [30/Jan/2004:10:47:38 +0100] "PROPFIND /svn/trunk/conf HTTP/1.1" 401 363
127.0.0.1 - Juanma [30/Jan/2004:10:47:38 +0100] "PROPFIND /svn/trunk/conf HTTP/1.1" 401 363
127.0.0.1 - Juanma [30/Jan/2004:10:47:39 +0100] "PROPFIND /svn/trunk/conf HTTP/1.1" 401 363
127.0.0.1 - Lektu [30/Jan/2004:10:47:46 +0100] "PROPFIND /svn/trunk/conf HTTP/1.1" 207 352
- error.log:
[Fri Jan 30 10:47:38 2004] [error] [client 127.0.0.1] Access denied: 'Juanma' PROPFIND /trunk/conf
[Fri Jan 30 10:47:39 2004] [error] [client 127.0.0.1] user Juanma: authentication failure for "/svn/trunk/conf": Password Mismatch
Browsing with IE (successfully):
- access.log:
127.0.0.1 - Juanma [30/Jan/2004:10:57:04 +0100] "GET /svn/trunk/conf/ HTTP/1.1" 401 363
127.0.0.1 - Lektu [30/Jan/2004:10:57:11 +0100] "GET /svn/trunk/conf/ HTTP/1.1" 200 1055
- error.log:
[Fri Jan 30 10:57:04 2004] [error] [client 127.0.0.1] Access denied: 'Juanma' GET /trunk/conf
Juanma
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: 207 Multi-Status using mod_authz_svn
Posted by Juanma Barranquero <jm...@wke.es>.
On Thu, 29 Jan 2004 12:32:01 -0500 (EST)
Jim Sokoloff <ji...@sokoloff.com> wrote:
> When *defining* groups, don't use the @ sign.
Well, it turns out that's not related to the problem. I'd say it *is* a
bug in the svn.exe client, because I can browse the repository with IE,
but the client is unable to do an "ls".
So (simplifying even more):
- httpd.conf:
<Location /svn>
DAV svn
SVNPath "C:/data/store/base"
AuthType Basic
AuthName "Subversion"
AuthUserFile conf/passwd
AuthzSVNAccessFile conf/authz_svn
Require valid-user
</Location>
- conf/authz_svn:
[/]
* = r
Lektu = rw
[/trunk/conf]
* =
Lektu = rw
Output from svn.exe is:
D:\> svn --no-auth-cache ls http://localhost/svn/trunk
conf/
www/
D:\> svn --no-auth-cache ls http://localhost/svn/trunk/conf
Authentication realm: <http://localhost:80> Subversion
Password for 'Juanma':
Authentication realm: <http://localhost:80> Subversion
Username: Lektu
Password for 'Lektu': **********
svn: PROPFIND request failed on '/svn/trunk/conf'
svn: PROPFIND of '/svn/trunk/conf': 207 Multi-Status (http://localhost)
Browsing with IE, it works as expected: I get a prompt, enter Juanma,
continue browsing, click over the "conf" link, get a prompt again, enter
Lektu and password, and I'm given access just fine. So obviously is not
a setup issue (or, "is not an obvious setup issue", your choice :)
Juanma
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: 207 Multi-Status using mod_authz_svn
Posted by Juanma Barranquero <le...@terra.es>.
On Thu, 29 Jan 2004 12:32:01 -0500 (EST), Jim Sokoloff <ji...@sokoloff.com> wrote:
> When *defining* groups, don't use the @ sign.
D'oh! Stupid, stupid me! :)
Thanks,
/L/e/k/t/u
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org