Fine-grained access control as in WebDAV with svn://

[Robert Wenner <ro...@atsec.com>]

Hi,

maybe this should better go to the development list; however:

For svn:// access, I want fine-grained access control (on a per-file 
basis) like WebDAV does.
[Maybe the repository could even hide files the user has no access to.]
Is this possible?

WebDAV works as intended, but svnserve ignores the WebDAV users and access 
rights files. 
conf/svnserveconf does not seem to have a setting to specify the access 
rights file, and the format of the password database is different from 
the one used with WebDAV, so I think these won't work together out of the 
box.

Google did not turn up anything useful.

I looked into the hooks to implement this myself, but even if there were 
hooks for check out, this would feel like a quick and dirty hack.

Is someone already working on such a feature?
A quick look at the task list did not turn out anything in that direction.

Any other comments on my problem?

Regards,

Robert

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Fine-grained access control as in WebDAV with svn://

["Glenn E. Sieb" <ge...@cibernet.com>]

Robert Wenner wrote:

>Hi,
>
>maybe this should better go to the development list; however:
>
>For svn:// access, I want fine-grained access control (on a per-file 
>basis) like WebDAV does.
>[Maybe the repository could even hide files the user has no access to.]
>Is this possible?
>
>WebDAV works as intended, but svnserve ignores the WebDAV users and access 
>rights files. 
>conf/svnserveconf does not seem to have a setting to specify the access 
>rights file, and the format of the password database is different from 
>the one used with WebDAV, so I think these won't work together out of the 
>box.
>
>Google did not turn up anything useful.
>
>I looked into the hooks to implement this myself, but even if there were 
>hooks for check out, this would feel like a quick and dirty hack.
>
>Is someone already working on such a feature?
>A quick look at the task list did not turn out anything in that direction.
>
>Any other comments on my problem?
>  
>
We use svn+ssh:// here, and if you look in the hooks/ directory, you'll 
see some nifty things.. like commit-access-control.pl & 
commit-access-control.cfg.. that's how we restrict here.. coupled with 
the hooks/pre-commit script! :)

My guess is, you could do something along these same lines--but be 
careful about usernames & such.. there's a whole warning in the book 
about using multiple access methods to the repositories... be sure to 
watch out for the caveats! :) In the print-version of the book it's on 
page 131 "Supporting Multiple Respository Access Methods"

Best,
--Glenn

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Fine-grained access control as in WebDAV with svn://

[Robert Wenner <ro...@atsec.com>]

On Saturday 22 January 2005 03:09, Ben Collins-Sussman wrote:
> No.  If you look at the table at the beginning of chapter 6, it
> explicitly says so.
Oops, thanks, I must have missed that %-)

> If you use svn:// or svn+ssh://, then at best you can get fine-grained
> *write* control by using a pre-commit hook script like
> commit-access-control.pl or svnperms.py.  But there's no fine-grained
> read control.
>
> It's on the "would be nice someday" list, but I don't think anyone's
> working on it or has any plans to do it soon.
If this feature isn't planned yet, I will maybe look into implementing it, 
since this would be really needed for us.
I'll take further discussion on this topic to the dev list.

Thanks again.

Robert

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Fine-grained access control as in WebDAV with svn://

[Ben Collins-Sussman <su...@collab.net>]

On Jan 21, 2005, at 4:50 PM, Robert Wenner wrote:

> Hi,
>
> maybe this should better go to the development list; however:
>
> For svn:// access, I want fine-grained access control (on a per-file
> basis) like WebDAV does.
> [Maybe the repository could even hide files the user has no access to.]
> Is this possible?

No.  If you look at the table at the beginning of chapter 6, it 
explicitly says so.

If you use svn:// or svn+ssh://, then at best you can get fine-grained 
*write* control by using a pre-commit hook script like 
commit-access-control.pl or svnperms.py.  But there's no fine-grained 
read control.

It's on the "would be nice someday" list, but I don't think anyone's 
working on it or has any plans to do it soon.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org