SVN Path-based Authentication Q...

[BRM <bm...@yahoo.com>]

I am administering a server running Apache Httpd with WebDAV serving a Subversion 1.6.6 repository set on an Ubuntu Server 10.04 LTS.

A while back I setup path-based authentication using mod_authz_svn in addition to the AuthUserFile directive for logins.
This has been working quite well; however, I recently needed to change some of the permissions due to a legal requirement that some users not be allowed to access certain paths.

My initial update was just to protect the paths in the AuthzSVNAccessFile:

[myrepo:/path/to/protected/area1/protectedItem]
@no_access_group =

[myrepo:/path/to/protected/area2/protectedItem]
@no_access_group =

All the protected paths have a common directory name that is not to be accessed.

However, I am concerned that this method will only work until a user (any user) copies a path (e.g. /path/to/protected/area2) to another path, and thus 'protectedItem' becomes available at the new path without anyone realizing it. Ideally I would have something like the following instead of having 6 or so copies of the above:

[myrepo:*/protectedItem]
@no_access_group =

I looked over the SVN Redbook information and the Apache2 2.2 documentation but could not find anything to say that was supported, etc.
Is there a way I can do this reliably? Upgrading the software (especially if it gets this functionality) would be relatively easy to do/request.


While I realize a better method would be to dump/filter/reload the repository we don't want to do that quite yet as we have a number of working copies on numerous machines that we do not want to invalidate as a result. I am considering it at some point, but only if absolutely necessary.

TIA,

Ben

Re: SVN Path-based Authentication Q...

[Andy Levy <an...@gmail.com>]

On Tue, Jul 3, 2012 at 4:42 PM, Thorsten Schöning <ts...@am-soft.de> wrote:
> Guten Tag BRM,
> am Dienstag, 3. Juli 2012 um 16:32 schrieben Sie:
>
>> [myrepo:*/protectedItem]
>> @no_access_group =
>
>> I looked over the SVN Redbook information and the Apache2 2.2
>> documentation but could not find anything to say that was supported, etc.
>
> There was something mentioned on the list, but I don't knwo if it's
> subversion core or something special to Wandisco.
>
>> You can in fact specify regular expressions to determine patterns for your
>> rules, and we support wildcards etc through that mechanism so it's pretty
>> powereful.
>
> http://svn.haxx.se/users/archive-2011-09/0372.shtml

That is specific to one (or more) of WANDisco's products.

Re: SVN Path-based Authentication Q...

[Thorsten Schöning <ts...@am-soft.de>]

Guten Tag BRM,
am Dienstag, 3. Juli 2012 um 16:32 schrieben Sie:

> [myrepo:*/protectedItem]
> @no_access_group =

> I looked over the SVN Redbook information and the Apache2 2.2
> documentation but could not find anything to say that was supported, etc.

There was something mentioned on the list, but I don't knwo if it's
subversion core or something special to Wandisco.

> You can in fact specify regular expressions to determine patterns for your
> rules, and we support wildcards etc through that mechanism so it's pretty
> powereful.

http://svn.haxx.se/users/archive-2011-09/0372.shtml

Else the following may help your:

http://svn.haxx.se/users/archive-2006-08/1054.shtml

Mit freundlichen Grüßen,

Thorsten Schöning

-- 
Thorsten Schöning       E-Mail:Thorsten.Schoening@AM-SoFT.de
AM-SoFT IT-Systeme      http://www.AM-SoFT.de/

Telefon.............030-2 1001-310
Fax...............05151-  9468- 88
Mobil..............0178-8 9468- 04

AM-SoFT GmbH IT-Systeme, Brandenburger Str. 7c, 31789 Hameln
AG Hanover HRB 207 694 - Geschäftsführer: Andreas Muchow