HAALLP! SSPI Authentication

[Steve Dwire <sd...@pcsigroup.com>]

We're running subversion under Apache with the mod_auth_sspi, and until
today it has been working wonderfully.  Today, our network administrator
needed to put a local secondary domain controller in our office to avoid
the cross-state traffic we used to have to reach the primary domain
controller.  The only box we had available to serve that additional
purpose was, you guessed it, our Subversion server.

 

I thought, "No problem. We'll just tell mod_auth_sspi to use itself as
the domain controller, and things will go even faster!"

 

Now that we've done this, our users fail to authenticate against the
domain, and we can't checkout, commit, or update.  I just gave a
presentation yesterday on the wonders of Subversion and gave everyone
the URL to our repository, and now this!

 

And, yes, I have read the subversion FAQ about SSPI. In faqt, I wrote it
-- what little there is. :-(  And I have revisited the latest
TortoiseSVN document and tried using the string literal
'<domaincontroller>' for the domain controller name. I've tried
commenting out the line entirely. I've tried providing SSPIDomain with
no value following (apache failed to boot with that one).

 

I can log in to the machine, and other domain authentication seems to
work in other applications.

 

Does anyone have any ideas what's gone wrong?

 

S_E_D

{Spam?} Re: {Spam?} HAALLP! SSPI Authentication

[Jeremy Bettis <je...@deadbeef.com>]

I am using mod_auth_SSPI on a secondary domain controller with no problems.
I did however have to make a number of fixes to mod_auth_sspi to get basic
authentication to work.  I also added a new flag to remove the domain name
from the user, so that I don't have to deal with DOMAIN\Username in my
access.conf

I have attached are the changes I made.

----- Original Message ----- 
From: Steve Dwire
To: users@subversion.tigris.org
Sent: Thursday, March 18, 2004 2:35 PM
Subject: {Spam?} HAALLP! SSPI Authentication


We're running subversion under Apache with the mod_auth_sspi, and until
today it has been working wonderfully.  Today, our network administrator
needed to put a local secondary domain controller in our office to avoid the
cross-state traffic we used to have to reach the primary domain controller.
The only box we had available to serve that additional purpose was, you
guessed it, our Subversion server.

I thought, "No problem. We'll just tell mod_auth_sspi to use itself as the
domain controller, and things will go even faster!"

Now that we've done this, our users fail to authenticate against the domain,
and we can't checkout, commit, or update.  I just gave a presentation
yesterday on the wonders of Subversion and gave everyone the URL to our
repository, and now this!

And, yes, I have read the subversion FAQ about SSPI. In faqt, I wrote it -- 
what little there is. :-(  And I have revisited the latest TortoiseSVN
document and tried using the string literal '<domaincontroller>' for the
domain controller name. I've tried commenting out the line entirely. I've
tried providing SSPIDomain with no value following (apache failed to boot
with that one).

I can log in to the machine, and other domain authentication seems to work
in other applications.

Does anyone have any ideas what's gone wrong?

S_E_D