Authentication issues

[Aaron Wood <wo...@gmail.com>]

I'm setting up http/https access for svn, and running into issues. 
The server is a windows XP (home, don't ask why) box, running apache
2.0.54, with mod_auth_sspi.

If I connect to the server with a browser, I get a proper
authentication challenge.  If I enter my user/pass, I can see the
latest rev of the repository.

If I try to do a co from the svn commandline, I get:

>svn co http://server/svn/test1
svn: PROPFIND request failed on '/svn/test1'
svn: PROPFIND of '/svn/test1': authorization failed (http://server)

My apache logs shows:
[client] - - [time] "PROPFIND /svn/test1 HTTP/1.1 401 384

when a browser connects I see:
[client] - - [time] "GET /svn/test1/ HTTP/1.1" 401 384
[client] - - [time] "GET /svn/test1/ HTTP/1.1" 401 384
[client] - DOMAIN\User [time] "GET /svn/test1/ HTTP/1.1" 200 218

If I try to pass my username in as part of the co from the
commandline, I get the same in the logs (appears to be ignored).

Furthermore, if I type in an invalid username in the prompt in the
browser window, it still works, and I see the username I entered
(asdfasdfasdf isn't a user on my system).

Relevant httpd.conf sections:

LoadModule sspi_auth_module modules/mod_auth_sspi.so
LoadModule dav_svn_module modules/mod_dav_svn.so
LoadModule authz_svn_module "<path to subversion install>/bin/mod_authz_svn.so"

.....

<Location /svn>
  DAV svn
  SVNParentPath /svn

  AuthName "SVN Server"
  AuthType SSPI
  SSPIAuth On
  SSPIAuthoritative On
  SSPIDomain MACHINENAME

  Require valid-user
</Locaton>

And help would be greatly appreciated.

Thanks,
Aaron

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Authentication issues

[Aaron Wood <wo...@gmail.com>]

On 9/26/05, Aaron Wood <wo...@gmail.com> wrote:
And if i change my httpd.conf to:

<Location /svn>
  DAV svn
  SVNParentPath /svn

  AuthName "SVN Server"
  AuthType SSPI
  SSPIAuth On
  SSPIAuhoritative On
  SSPIDomain MACHINENAME
  SSPIOfferBasic On

  Require valid-user

 AuthzSVNAccessFile "/svn/svnaccess.conf"

</Location>

coupled with /svn/svnaccess.conf:

[/]
MACHINENAME\User=rw

and it all works the way I expect, with the correct rejection of invalid names.

However, it appears for this to work, I need to add each user to the
svnaccess file.  If I run without mod_authz_svn, then anyone can still
connect to the repository, which is probably just an Apache conf bug
on my end...

This is still confusing to setup...  But I'm making progress now.

Again, any help appreciated.

-Aaron

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Authentication issues

[Aaron Wood <wo...@gmail.com>]

On 9/26/05, Aaron Wood <wo...@gmail.com> wrote:
> My apache logs shows:
> [client] - - [time] "PROPFIND /svn/test1 HTTP/1.1 401 384
>
> when a browser connects I see:
> [client] - - [time] "GET /svn/test1/ HTTP/1.1" 401 384
> [client] - - [time] "GET /svn/test1/ HTTP/1.1" 401 384
> [client] - DOMAIN\User [time] "GET /svn/test1/ HTTP/1.1" 200 218

Further, if I try to mount the repository via WebDAV on my Mac (OSX
10.3), I see:

[client] - - [time] "OPTIONS /svn/test1 HTTP/1.1" 401 545, and it
doesn't mount (nor is there an authentication challenge)

And if i change my httpd.conf to:

<Location /svn>
  DAV svn
  SVNParentPath /svn
</Location>

I see a flurry of logs for PROPFINDS that all return 207 and then some
other numbers

-Aaron

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org