You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by karthik kg <kg...@gmail.com> on 2014/04/07 09:40:54 UTC
SVN Query about granting access
Hi Team,
Hope you doing good.
SVN was a good version control tool for us and it really helpfull.
Currently i have faced a challenge on providing read access for a
particular user for a particular repository.
Repository name - TTN
Location on the server -
/apps/bss/SubVersion_Repository/TTN
I tired editing the /var/opt/app/SubVersion_Repository/NTT/conf/auth file
with below parameter for providing read only access to the TTN repository.
[repository:/NTT]
d389678 = 'r'
But even after changing the auth file, i can see i hav write access to the
user d389678.
My query is, is there any file that needs to be updated? if yes, kindly
provide us the detailed view of the parameter that needs to be updated on
the file.
Re: SVN Query about granting access
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Geoff Field wrote on Tue, Apr 08, 2014 at 09:03:43 +1000:
> > From: Daniel Shahaf
> > Sent: Monday, 7 April 2014 18:13 PM
> >
> > karthik kg wrote on Mon, Apr 07, 2014 at 17:40:54 +1000:
> > > Repository name - TTN
> > > Location on the server -
> > >
> > > /apps/bss/SubVersion_Repository/TTN
> > >
> > >
> > > I tired editing the
> > /var/opt/app/SubVersion_Repository/NTT/conf/auth
> > > file with below parameter for providing read only access to
> > the TTN repository.
> > >
> > >
> > > [repository:/NTT]
> > >
> > > d389678 = 'r'
>
> As well as what Daniel has quite rightly said, it looks like there's a
> space at the start of the line. I seem to remember another message on
> this list commenting that spaces at the start of the line might not be
> a good idea.
Good point. Spaces at the start of a line may cause it to be interpreted
as a continuation line. If this happened in the context of authz rules
(lines ending in = or =r or =rw) it would invariably result in a syntax
error (so all requests to the repositories governed by the authz file
would error with HTTP 500), but in other sections ([groups], [aliases]) or
other files (svnserve.conf, fsfs.conf, ~/.subversion/config, ...) it may
result in a syntactically-valid file that doesn't do what it appears to do.
For example, try this:
# in ~/.subversion/config
[miscellany]
enable-auto-props = yes
[auto-props]
*.t = svn:eol-style=native;
*.c = svn:keywords=Id;
(Incidentally, this particular example exposes a bug:
<ht...@tarsus.local2>)
Daniel
Re: SVN Query about granting access
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Geoff Field wrote on Wed, Apr 09, 2014 at 13:58:30 +1000:
> Do you grant global read/write access to that repository at all?
> Not sure, about this. Can you please tell me where this param
> value specified?
>
> In your Subversion.conf file, there could be a line - most likely
> related to that repository - that says something like:
>
It's good practice not to refer to files by name but by function since
the name may change among vendors. In particular, when I saw
"subversion.conf" I thought you were referring to an httpd.conf
directives files.
> Of course, I'm making a lot of assumptions here, but that's what works
> for us. We've been known to make specific repositories private in our
> configuration by saying (for that repository):
>
> * =
>
> I'm not totally convinced it will work, since the individual settings
> seem to override the global ones. More knowledgeable heads than mine
> might have more of a clue.
There are a number of cases where settings are overridden by other
settings. For example: when a section name is repeated; when both
[/path] and [foo:/path] exist; when a [/path] stanza contains multiple
LHS tokens that match the authenticated username. Also there is the
question of whether the correct file is being edited (an easy way to
test this is to insert an intentional syntax error into the file; the
next request on a new connection should then fail with HTTP 500).
(And before someone points out that causing HTTP 500's on a live site is
bad practice: it's bad practice to test an authz file on a live site, so
I'm assuming the edits are done initially in a test setup (maybe a test
<Location> with a different authentication backend).)
My advice is: use 'svnauthz accessof' to debug your authz file. If you
can't get it to do what you want, make a minimal example that shows the
problem (as few users / paths / repos as possible) and post it here with
an explanation of what semantics (access matrix) you'd like to achieve.
http://subversion.apache.org/docs/release-notes/1.8#svnauthz_accessof
Daniel
RE: SVN Query about granting access
Posted by Geoff Field <Ge...@aapl.com.au>.
From: karthik kg
Sent: Wednesday, 9 April 2014 13:17 PM
Hi Geoff,
Apologies for replying to you. Please find my comments fro your queries below.
Replying directly to me is not a problem, really. What might be a problem is that I don't know as many of the answers as some of the other contributors to this mailing list.
What result/message is the user actually seeing? I'm facing No ERROR at the moment.
Fair enough. From the description, that's what I'd expect.
From what I'm seeing, you're trying to give that specific user read-only access, but they're getting read/write access. Yes, That's right. Even post changing the user settings, i m getting read-write access for that user(d389678)
Some of my following queries are based on Windows and might not apply on your platform: Oh, anyway my platform is LINUX
I thought it might have been, but it's worth being sure. What specific version?
Have they actually logged out and in again? Yes, Tried
Have you restarted the httpd daemon after reconfiguring? (This shouldn't be necessary, but it could be worth a try.) Yes Tried.
Do you grant global read/write access to that repository at all? Not sure, about this. Can you please tell me where this param value specified?
In your Subversion.conf file, there could be a line - most likely related to that repository - that says something like:
* = rw
Alternatively, you could have something like this to control global access:
[/]
* = rw
If there's a line like that in there, it's possible it will override the individual user settings. To make it global read-only, simply change it to:
* = r
Of course, I'm making a lot of assumptions here, but that's what works for us. We've been known to make specific repositories private in our configuration by saying (for that repository):
* =
I'm not totally convinced it will work, since the individual settings seem to override the global ones. More knowledgeable heads than mine might have more of a clue.
Having said all this, one has to ask if restricting that user's access is strictly necessary. Given that SVN logs all writes and changes and that everything can be reversed, is it really such a huge risk?
On the other hand, of course, there's the learning exercise for working out how to set the configuration file up.
Regards,
Geoff
--
Apologies for the auto-generated legal boilerplate added by our IT department:
- The contents of this email, and any attachments, are strictly private
and confidential.
- It may contain legally privileged or sensitive information and is intended
solely for the individual or entity to which it is addressed.
- Only the intended recipient may review, reproduce, retransmit, disclose,
disseminate or otherwise use or take action in reliance upon the information
contained in this email and any attachments, with the permission of
Australian Arrow Pty. Ltd.
- If you have received this communication in error, please reply to the sender
immediately and promptly delete the email and attachments, together with
any copies, from all computers.
- It is your responsibility to scan this communication and any attached files
for computer viruses and other defects and we recommend that it be
subjected to your virus checking procedures prior to use.
- Australian Arrow Pty. Ltd. does not accept liability for any loss or damage
of any nature, howsoever caused, which may result
directly or indirectly from this communication or any attached files.
Re: SVN Query about granting access
Posted by karthik kg <kg...@gmail.com>.
Hi Geoff,
Apologies for replying to you. Please find my comments fro your queries
below.
What result/message is the user actually seeing? I'm facing No ERROR at
the moment.
>From what I'm seeing, you're trying to give that specific user read-only
access, but they're getting read/write access. Yes, That's right. Even post
changing the user settings, i m getting read-write access for that
user(d389678)
Some of my following queries are based on Windows and might not apply on
your platform: Oh, anyway my platform is LINUX
Have they actually logged out and in again? Yes, Tried
Have you restarted the httpd daemon after reconfiguring? (This shouldn't
be necessary, but it could be worth a try.) Yes Tried.
Do you grant global read/write access to that repository at all? Not sure,
about this. Can you please tell me where this param value specified?
Thanks.
On Tue, Apr 8, 2014 at 3:23 PM, Geoff Field <Ge...@aapl.com.au> wrote:
> Hi Karthik,
>
> Please ensure you reply to the whole group, as there are many people on
> the mailing list who are far more knowledgeable than I. Also, the
> convention seems to be to use plain-text and to reply within/under the
> quoted text.
>
> From: karthik kg
> Sent: Tuesday, 8 April 2014 15:11 PM
> To: Geoff Field
> Subject: Re: SVN Query about granting access
>
>
> Hi Geoff,
>
> Thanks for the information. But still it didnt work out.
>
> What result/message is the user actually seeing?
>
> From what I'm seeing, you're trying to give that specific user read-only
> access, but they're getting read/write access.
>
> Some of my following queries are based on Windows and might not apply on
> your platform:
>
> Have they actually logged out and in again?
>
> Have you restarted the httpd daemon after reconfiguring? (This shouldn't
> be necessary, but it could be worth a try.)
>
> Do you grant global read/write access to that repository at all?
>
>
> My repository uses httpd and the SVN path in Subversion.conf is
> "SVNPath /var/opt/app/photon/repository/NTT"
>
> That's a start. Daniel also asked for: "whether you use -r/--root
> (svnserve) or SVNParentPath (httpd) and if so what path it is set to."
>
> Those more knowledgeable about using httpd on a *nix platform (I'm using
> Windows at present) will probably be looking for a more complete extract
> from the Subversion.conf file about now.
>
> Regards,
>
> Geoff
>
> On Tue, Apr 8, 2014 at 9:03 AM, Geoff Field <
> Geoff_Field@aapl.com.au> wrote:
>
>
> > From: Daniel Shahaf
> > Sent: Monday, 7 April 2014 18:13 PM
>
> >
> > karthik kg wrote on Mon, Apr 07, 2014 at 17:40:54 +1000:
> > > Repository name - TTN
> > > Location on the server -
> > >
> > > /apps/bss/SubVersion_Repository/TTN
> > >
> > >
> > > I tired editing the
> > /var/opt/app/SubVersion_Repository/NTT/conf/auth
> > > file with below parameter for providing read only
> access to
> > the TTN repository.
> > >
> > >
> > > [repository:/NTT]
> > >
> > > d389678 = 'r'
>
>
> As well as what Daniel has quite rightly said, it looks
> like there's a space at the start of the line. I seem to remember another
> message on this list commenting that spaces at the start of the line might
> not be a good idea.
>
> Also, Daniel doesn't say it, but the repository name
> doesn't look right. Daniel's edited version should get your user
> authenticated correctly.
>
>
> > > But even after changing the auth file, i can see i hav
> > write access to
> > > the user d389678.
> > >
> > > My query is, is there any file that needs to be
> updated? if yes,
> > > kindly provide us the detailed view of the parameter
> that
> > needs to be
> > > updated on the file.
> >
> > There isn't any other file, but you didn't edit that
> file correctly.
> >
> > Don't use single quotes (') in the value. It is not
> > guaranteed to work and may stop working in future
> versions.
> >
> > I think you mean:
> >
> > [TTN:/]
> > d389678 = r
> >
> > That is: the "/" path within the repository called
> "TTN".
> >
> > If this doesn't work, please indicate whether you use
> > svnserve or httpd, and whether you use -r/--root
> (svnserve)
> > or SVNParentPath (httpd) and if so what path it is set
> to.
>
>
> Good luck,
>
> Geoff
>
> --
> Apologies for the auto-generated legal boilerplate added by our IT
> department:
>
>
> - The contents of this email, and any attachments, are strictly private
> and confidential.
> - It may contain legally privileged or sensitive information and is
> intended
> solely for the individual or entity to which it is addressed.
> - Only the intended recipient may review, reproduce, retransmit, disclose,
> disseminate or otherwise use or take action in reliance upon the
> information
> contained in this email and any attachments, with the permission of
> Australian Arrow Pty. Ltd.
> - If you have received this communication in error, please reply to the
> sender
> immediately and promptly delete the email and attachments, together with
> any copies, from all computers.
> - It is your responsibility to scan this communication and any attached
> files
> for computer viruses and other defects and we recommend that it be
> subjected to your virus checking procedures prior to use.
> - Australian Arrow Pty. Ltd. does not accept liability for any loss or
> damage
> of any nature, howsoever caused, which may result
> directly or indirectly from this communication or any attached files.
>
>
>
RE: SVN Query about granting access
Posted by Geoff Field <Ge...@aapl.com.au>.
Hi Karthik,
Please ensure you reply to the whole group, as there are many people on the mailing list who are far more knowledgeable than I. Also, the convention seems to be to use plain-text and to reply within/under the quoted text.
From: karthik kg
Sent: Tuesday, 8 April 2014 15:11 PM
To: Geoff Field
Subject: Re: SVN Query about granting access
Hi Geoff,
Thanks for the information. But still it didnt work out.
What result/message is the user actually seeing?
>From what I'm seeing, you're trying to give that specific user read-only access, but they're getting read/write access.
Some of my following queries are based on Windows and might not apply on your platform:
Have they actually logged out and in again?
Have you restarted the httpd daemon after reconfiguring? (This shouldn't be necessary, but it could be worth a try.)
Do you grant global read/write access to that repository at all?
My repository uses httpd and the SVN path in Subversion.conf is "SVNPath /var/opt/app/photon/repository/NTT"
That's a start. Daniel also asked for: "whether you use -r/--root (svnserve) or SVNParentPath (httpd) and if so what path it is set to."
Those more knowledgeable about using httpd on a *nix platform (I'm using Windows at present) will probably be looking for a more complete extract from the Subversion.conf file about now.
Regards,
Geoff
On Tue, Apr 8, 2014 at 9:03 AM, Geoff Field <Ge...@aapl.com.au> wrote:
> From: Daniel Shahaf
> Sent: Monday, 7 April 2014 18:13 PM
>
> karthik kg wrote on Mon, Apr 07, 2014 at 17:40:54 +1000:
> > Repository name - TTN
> > Location on the server -
> >
> > /apps/bss/SubVersion_Repository/TTN
> >
> >
> > I tired editing the
> /var/opt/app/SubVersion_Repository/NTT/conf/auth
> > file with below parameter for providing read only access to
> the TTN repository.
> >
> >
> > [repository:/NTT]
> >
> > d389678 = 'r'
As well as what Daniel has quite rightly said, it looks like there's a space at the start of the line. I seem to remember another message on this list commenting that spaces at the start of the line might not be a good idea.
Also, Daniel doesn't say it, but the repository name doesn't look right. Daniel's edited version should get your user authenticated correctly.
> > But even after changing the auth file, i can see i hav
> write access to
> > the user d389678.
> >
> > My query is, is there any file that needs to be updated? if yes,
> > kindly provide us the detailed view of the parameter that
> needs to be
> > updated on the file.
>
> There isn't any other file, but you didn't edit that file correctly.
>
> Don't use single quotes (') in the value. It is not
> guaranteed to work and may stop working in future versions.
>
> I think you mean:
>
> [TTN:/]
> d389678 = r
>
> That is: the "/" path within the repository called "TTN".
>
> If this doesn't work, please indicate whether you use
> svnserve or httpd, and whether you use -r/--root (svnserve)
> or SVNParentPath (httpd) and if so what path it is set to.
Good luck,
Geoff
--
Apologies for the auto-generated legal boilerplate added by our IT department:
- The contents of this email, and any attachments, are strictly private
and confidential.
- It may contain legally privileged or sensitive information and is intended
solely for the individual or entity to which it is addressed.
- Only the intended recipient may review, reproduce, retransmit, disclose,
disseminate or otherwise use or take action in reliance upon the information
contained in this email and any attachments, with the permission of
Australian Arrow Pty. Ltd.
- If you have received this communication in error, please reply to the sender
immediately and promptly delete the email and attachments, together with
any copies, from all computers.
- It is your responsibility to scan this communication and any attached files
for computer viruses and other defects and we recommend that it be
subjected to your virus checking procedures prior to use.
- Australian Arrow Pty. Ltd. does not accept liability for any loss or damage
of any nature, howsoever caused, which may result
directly or indirectly from this communication or any attached files.
RE: SVN Query about granting access
Posted by Geoff Field <Ge...@aapl.com.au>.
> From: Daniel Shahaf
> Sent: Monday, 7 April 2014 18:13 PM
>
> karthik kg wrote on Mon, Apr 07, 2014 at 17:40:54 +1000:
> > Repository name - TTN
> > Location on the server -
> >
> > /apps/bss/SubVersion_Repository/TTN
> >
> >
> > I tired editing the
> /var/opt/app/SubVersion_Repository/NTT/conf/auth
> > file with below parameter for providing read only access to
> the TTN repository.
> >
> >
> > [repository:/NTT]
> >
> > d389678 = 'r'
As well as what Daniel has quite rightly said, it looks like there's a space at the start of the line. I seem to remember another message on this list commenting that spaces at the start of the line might not be a good idea.
Also, Daniel doesn't say it, but the repository name doesn't look right. Daniel's edited version should get your user authenticated correctly.
> > But even after changing the auth file, i can see i hav
> write access to
> > the user d389678.
> >
> > My query is, is there any file that needs to be updated? if yes,
> > kindly provide us the detailed view of the parameter that
> needs to be
> > updated on the file.
>
> There isn't any other file, but you didn't edit that file correctly.
>
> Don't use single quotes (') in the value. It is not
> guaranteed to work and may stop working in future versions.
>
> I think you mean:
>
> [TTN:/]
> d389678 = r
>
> That is: the "/" path within the repository called "TTN".
>
> If this doesn't work, please indicate whether you use
> svnserve or httpd, and whether you use -r/--root (svnserve)
> or SVNParentPath (httpd) and if so what path it is set to.
Good luck,
Geoff
--
Apologies for the auto-generated legal boilerplate added by our IT department:
- The contents of this email, and any attachments, are strictly private
and confidential.
- It may contain legally privileged or sensitive information and is intended
solely for the individual or entity to which it is addressed.
- Only the intended recipient may review, reproduce, retransmit, disclose,
disseminate or otherwise use or take action in reliance upon the information
contained in this email and any attachments, with the permission of
Australian Arrow Pty. Ltd.
- If you have received this communication in error, please reply to the sender
immediately and promptly delete the email and attachments, together with
any copies, from all computers.
- It is your responsibility to scan this communication and any attached files
for computer viruses and other defects and we recommend that it be
subjected to your virus checking procedures prior to use.
- Australian Arrow Pty. Ltd. does not accept liability for any loss or damage
of any nature, howsoever caused, which may result
directly or indirectly from this communication or any attached files.
Re: SVN Query about granting access
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
karthik kg wrote on Mon, Apr 07, 2014 at 17:40:54 +1000:
> Repository name - TTN
> Location on the server -
>
> /apps/bss/SubVersion_Repository/TTN
>
>
> I tired editing the /var/opt/app/SubVersion_Repository/NTT/conf/auth file
> with below parameter for providing read only access to the TTN repository.
>
>
> [repository:/NTT]
>
> d389678 = 'r'
>
>
> But even after changing the auth file, i can see i hav write access to the
> user d389678.
>
> My query is, is there any file that needs to be updated? if yes, kindly
> provide us the detailed view of the parameter that needs to be updated on
> the file.
There isn't any other file, but you didn't edit that file correctly.
Don't use single quotes (') in the value. It is not guaranteed to work
and may stop working in future versions.
I think you mean:
[TTN:/]
d389678 = r
That is: the "/" path within the repository called "TTN".
If this doesn't work, please indicate whether you use svnserve or httpd,
and whether you use -r/--root (svnserve) or SVNParentPath (httpd) and
if so what path it is set to.
Daniel