Administrate of hundreds of users, groups and projects?

[qbase <qb...@gmail.com>]

Hi

We have been running Subversion for a couple of months, everything has
worked great. But that been with only a small number of users(15), groups(7)
and projects(5), It hasn't been too much work administrating this, adding
users to Apache and editing our authfile(groups and access to projects.)
Now the interested has grown and we are thinking of using subversion for
many more of our development projects.

We need to administrate Subversion for hundreds of users/groups and perhaps
thousands of projects. Administrating through config files isn't an option
anymore. Need an easy and flexible service to do this, it would be great if
it be project managers could administrate the groups them self without
taking resources from sysadmins.

I know there isn't any official admin tool for subversion, but is it
planned? If not is there an reliable alternative for many years to come?
I've seen discussions about connecting OpenLDAP to Apache. Would this make
it possible to both administrate users, groups and access control of groups
to projects?

Any other suggestions? This is an important decision for us, want to avoid
using temporary or propriety solutions.

Regards,
Markus

Re: Administrate of hundreds of users, groups and projects?

[Jorge Uriarte <jo...@omelas.net>]

qbase wrote:
> Hi
> 
> We have been running Subversion for a couple of months, everything has 
> worked great. But that been with only a small number of users(15), 
> groups(7) and projects(5), It hasn't been too much work administrating 
> this, adding users to Apache and editing our authfile(groups and access 
> to projects.)
> Now the interested has grown and we are thinking of using subversion for 
> many more of our development projects.
> 

We're using Subversion now for 200+ users, with around 30+ groups; we
hold a lot of parallel-teams structure that forces us to grant
permissions selectively on different paths of the tree.

We use mod_authz_svn, and until recently we've kept that hell manually
editing the files.

I'm finishing Subauthz now, just to scratch that particular itch.
My aim is to finish it soon, as least to a grade I can call it 1.0.

http://omelas.net/Subauthz

I know there are some other tools out there, though none of them seemed
to scratch me exactly as I needed... and it's been a great excuse to
play with Ruby and Rails for a while.

What it currently does:
* Manage multiple configuration-file pairs (htpasswd's & mod_svn_authz's).
* Create and modify users and passwords
* Create and modify groups of users
* Create paths and manage permissions on them
* Keep track of previous versions of files

What it lacks (and it will soon have):
* Manage multiple repositories per configuration ([repo:/path/] paths)
* A better look (no more than a wireframe, currently!)
* Pagination
* A way to access to the permissions-file history

What I'd like to add 'someday':
* Management of users in repos other than Apache's basic htpasswd files
(LDAP??)
* Embbedded security? (currently I use Apache to sec the access to the tool)
* Some SVN utilities (check repo's paths, create them if wanted, ...)

BTW; has anybody any suggestion about licensing?
I'm currently slightly towards GPL...

_
Jorge



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Administrate of hundreds of users, groups and projects?

[Andy Levy <an...@gmail.com>]

On 12/15/05, Greg Thomas <th...@omc.bt.co.uk> wrote:
> (*) I don't think LDAP groups can be passed down to the
> AuthzSVNAccessFile, but I'm happy to be corrected. If you could, then
> you could get away with just editing AuthzSVNAccessFile if you're
> using a single repository solution.

It's kind of indirect, but couldn't one just write a script to pull
the user/group data from LDAP and populate the AuthzSVNAccessFile,
either on-demand or on a scheduled basis?

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Administrate of hundreds of users, groups and projects?

[Greg Thomas <th...@omc.bt.co.uk>]

On Thu, 15 Dec 2005 17:06:33 +0100, qbase <qb...@gmail.com> wrote:

> Would this make
>it possible to both administrate users, groups and access control of groups
>to projects?

Yes. For example, you can configure Apache to only allow users in the
svn-project1 LDAP group to access the repository project1, and users
in the svn-project2 LDAP group to access the repository project2, and
so on.

That means you will have to;
1) Reconfigure Apache for each new project (*)
2) Use your preferred LDAP solution to manage users, their passwords
and groups. 

If you're already using LDAP, then 2) becomes relatively simply. You
just need to sort out their groups.

(*) I don't think LDAP groups can be passed down to the
AuthzSVNAccessFile, but I'm happy to be corrected. If you could, then
you could get away with just editing AuthzSVNAccessFile if you're
using a single repository solution.

HTH,

Greg
-- 
This post represents the views of the author and does
not necessarily accurately represent the views of BT.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org