Re[4]: administrate AuthzSVNAccessFile with many users and repositories

["Sergey A. Kobzar" <ks...@uaic.net>]

Hello André,

Friday, July 22, 2005, 12:04:38 PM, you wrote:

>> > ... so you might run some kind of LDAP server for authentication.
>> > This is usable by Apache through mod_ldap and you can use
>> > whatever tool you usually use for user/group administration there.
>> 
>> What's tool, for example?

> Ahem... I meant 'tools for user administration under Windows'.

:)

>> chown works only for whole repository...

> I have setup a mapping between LDAP user groups and repository
> by using mod_perl and something similar to the following in
> /etc/apache2/conf.d/subversion.conf

> <Perl >
> #!/usr/bin/perl

> my $svnbase = '/data/svn/repository';

> opendir(DIR, $svnbase)
>   or die "Unable to open SVN repository base '$svnbase'\n";

> while (my $project = readdir(DIR)) {
>   next unless $project =~ /^[[:alnum:]_\-]+$/;
>   $Location{"/repository/$project"} = {
>     DAV => 'svn',
>     SVNPath => "$svnbase/$project",

>     AuthType => 'Basic',
>     AuthName => "'Subversion repository for project $project'",
>     AuthLDAPAuthoritative => 'on',
>     AuthLDAPURL => 'ldap://.... ?sub?(objectClass=*)',
>     AuthLDAPBindDN => '....
>     AuthLDAPBindPassword => '...
>     AuthLDAPGroupAttribute => 'member',
>     AuthLDAPGroupAttributeIsDN => 'on',

>     SSLRequireSSL => 1,

>     [...]
>     LimitExcept => {
>       'GET PROPFIND OPTIONS NAME REPORT' => {
>         Require => "group cn=$project-committers,ou=....",
>       }
>     },
>     Limit => {
>       'GET PROPFIND OPTIONS NAME REPORT' => {
>         Require => "group cn=$project-readers,ou=...",
>       }
>     },
>   };
> }
> </Perl>

> This requires LDAP groups '<project>-committers' and ..-readers
> for each project and one repository per project and yields
> per-project access (and is what _we_ need).

> This certainly can be tweaked to per-directory access and/or
> a single repository.

Thanks! It's very useful for me! I'll try it.

> Andre'



-- 
Best regards,
 Sergey                            mailto:ksa@uaic.net


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org