You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@subversion.apache.org by "Bogdan B. Rudas" <bo...@nivalnetwork.com> on 2009/06/23 16:43:26 UTC

AuthzSVNAccessFile and single read-only user.

Hello!
I have set of repos under Apache 2.2 https server with SVN 1.5.1
I use LDAP authentification to for users.
I would like to limit one special user to read-only access, we use this user for automated checkout.
I try with config:

[/]
rouser = r
* = rw

But "rouser" still have write access to repos. Changing order of lines did no solve a problem.
"rouser" is member of corresponding LDAP groups.

I get working configuration with something like this:

[/]
touser = r
user1 = rw
user2 = rw
....

But I would like to control access mostly via LDAP, so I need '* = rw' or something similar.

Here is part of apache vhost configuration.

<Location />
        AuthBasicProvider ldap
        AuthType Basic
        AuthName "Use your AD account"
        AuthLDAPBindDN ".................."
        AuthLDAPBindPassword "....."
        AuthLDAPURL "................?sAMAccountName?sub?(objectClass=user)"
        AuthzLDAPAuthoritative on
        AuthzSVNAccessFile /var/svn/svnaccess.conf
</Location>

<Location /com>
  DAV svn
  SVNPath /var/svn/com/
  satisfy all
  require valid-user
  require ldap-group CN=SVN_Com,OU=SVN,........
</Location>

<Location /ticket.system>
  DAV svn
  SVNPath /var/svn/ticket.system/
  satisfy all
  require valid-user
  require ldap-group CN=TicketSystem,OU=SVN.........
</Location>

How can I implement r/o access for single authentificated user ?

-- 
Bogdan Rudas
System Administrator
Nival Network
bogdan.rudas@nivalnetwork.com

23, Matusevicha st., office 103, 
Minsk, Belarus,
Tel: +375 17 2538272
http://www.nivalnetwork.com

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2364547

To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].

Re: AuthzSVNAccessFile and single read-only user.

Posted by Andrey Repin <an...@freemail.ru>.

Greetings, Bogdan B. Rudas!

> I have set of repos under Apache 2.2 https server with SVN 1.5.1
> I use LDAP authentification to for users.
> I would like to limit one special user to read-only access, we use this user for automated checkout.
> I try with config:

> [/]
> rouser = r
> * = rw

[/]
* = r
~readonlyuser = rw


--
WBR,
 Andrey Repin (anrdaemon@freemail.ru) 25.06.2009, <19:50>

Sorry for my terrible english...

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2365359

To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].

RE: AuthzSVNAccessFile and single read-only user.

Posted by km...@rockwellcollins.com.

"Todd C. Gleason" <tg...@impac.com> wrote on 06/23/2009 12:16:12 PM:
> > -----Original Message-----
> > From: Bogdan B. Rudas [mailto:bogdan.rudas@nivalnetwork.com]
> > Sent: Tuesday, June 23, 2009 10:43 AM
> > To: users@subversion.tigris.org
> > Subject: AuthzSVNAccessFile and single read-only user.
> > 
> > Hello!
> > I have set of repos under Apache 2.2 https server with SVN 1.5.1
> > I use LDAP authentification to for users.
> > I would like to limit one special user to read-only access, we use
> this
> > user for automated checkout.
> > I try with config:
> > 
> > [/]
> > rouser = r
> > * = rw
> 
> My observation has been that at any level, a user is granted the union
> of all access specified.  If not specified at a given directory level,
> then parent paths are used.
> 
> So you could have 
> 
> [/]
> * = rw
> 
> [/dir]
> rouser = r
> 
> and specify this for every directory at the top level.  It still will
> not prevent rouser from creating new directories under the root, though.

Assuming you only have one user, you might try:

[/]
rouser = r
~rouser = rw

You may also have more luck using "$authenticated = rw" instead of "* = 
rw".

Neither of these are tested, but both "~", and the "$" tokens seem to
be very infrequently mentioned and only documented with svnserve,
but seem to be supported with mod_authz_svn...

Kevin R.


### This file is an example authorization file for svnserve. 
### Its format is identical to that of mod_authz_svn authorization 
### files. 
### As shown below each section defines authorizations for the path and 
### (optional) repository specified by the section name. 
### The authorizations follow. An authorization line can refer to: 
### - a single user, 
### - a group of users defined in a special [groups] section, 
### - an alias defined in a special [aliases] section, 
### - all authenticated users, using the '$authenticated' token, 
### - only anonymous users, using the '$anonymous' token, 
### - anyone, using the '*' wildcard. 
### 
### A match can be inverted by prefixing the rule with '~'. Rules can 
### grant read ('r') access, read-write ('rw') access, or no access 
### ('').

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2364619

To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].

RE: AuthzSVNAccessFile and single read-only user.

Posted by "Todd C. Gleason" <tg...@impac.com>.

> -----Original Message-----
> From: Bogdan B. Rudas [mailto:bogdan.rudas@nivalnetwork.com]
> Sent: Tuesday, June 23, 2009 10:43 AM
> To: users@subversion.tigris.org
> Subject: AuthzSVNAccessFile and single read-only user.
> 
> Hello!
> I have set of repos under Apache 2.2 https server with SVN 1.5.1
> I use LDAP authentification to for users.
> I would like to limit one special user to read-only access, we use
this
> user for automated checkout.
> I try with config:
> 
> [/]
> rouser = r
> * = rw

My observation has been that at any level, a user is granted the union
of all access specified.  If not specified at a given directory level,
then parent paths are used.

So you could have 

[/]
* = rw

[/dir]
rouser = r

and specify this for every directory at the top level.  It still will
not prevent rouser from creating new directories under the root, though.

Of course you could have a read-only group and a read-write group and
naturally avoid overlapping permissions.  But this flexibility (full
path-based authentication) does require you to list all your users in
the authz file.

I know of one other trick you can possibly apply, which is to set up
your httpd-ssl.conf to use two configurations.  One configuration
specifies the read-only configuration and points to the authz file.  The
other is full read-write access, and bypasses the authz file, or else
uses a different authz file.  We use this for our admins to be able to
write to tags and other restricted locations.  To do it you should just
have to configure two <Location> sections with duplicate SVNPath or
SVNParentPath, and separate configuration of the AuthzSVNAccessFile (or
lack thereof).

Note that if you do this, the read-only users have a different URL for
access than the read-write users.  Hopefully you can manage that
possible source of confusion.  In your case (automated checkout) it is
probably nothing to worry about.  If you were creating a WC this way and
intended to modify and commit from it later, I think you would have to
use 

	svn switch --relocate

to point it back at the read-write URL.

Caveat:  My site uses NTLM instead of LDAP for Subversion so I don't
know whether LDAP can do anything more sophisticated than what I have
described above, nor whether it even applies to LDAP.

--Todd

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2364562

To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].