You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Andreas Hasenack <an...@mandriva.com.br> on 2007/06/14 12:53:18 UTC
Re: What are the benefits of using LDAP to authenticate users to
SVN
On Thu, Jun 14, 2007 at 06:14:46PM +0530, nikhil gupta wrote:
> Hi Andy,
>
> Thanks for the reply...
>
> But the benefits that you mentioned can also be achieved using the
> SSPI authentication, AFAIK. Are there any additional benefits that
> LDAP provides over SSPI?
LDAP is not just authentication: you can store groups there, for
example, and use it as a source of authorizarion.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: What are the benefits of using LDAP to authenticate users to
SVN
Posted by Shirish Jain <li...@getafix.net>.
Andy Levy said the following on 6/14/2007 10:56 PM:
>
> You mean one can use LDAP groups in conjunction w/ SVN's per-directory
> authorization? Got a link? I need to figure out how to do exactly that
> for our next big SVN rollout (whenever that happens).
not an option at this stage for mod_svn_authz. its for the 'group'
directive for Apache configuration not SVN configuration.
Best,
SJ
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: What are the benefits of using LDAP to authenticate users to
SVN
Posted by Andreas Hasenack <an...@mandriva.com.br>.
On Thu, Jun 14, 2007 at 08:56:01AM -0400, Andy Levy wrote:
> On 6/14/07, Andreas Hasenack <an...@mandriva.com.br> wrote:
> > On Thu, Jun 14, 2007 at 06:14:46PM +0530, nikhil gupta wrote:
> > > Hi Andy,
> > >
> > > Thanks for the reply...
> > >
> > > But the benefits that you mentioned can also be achieved using the
> > > SSPI authentication, AFAIK. Are there any additional benefits that
> > > LDAP provides over SSPI?
> >
> > LDAP is not just authentication: you can store groups there, for
> > example, and use it as a source of authorizarion.
>
> You mean one can use LDAP groups in conjunction w/ SVN's per-directory
> authorization? Got a link? I need to figure out how to do exactly that
> for our next big SVN rollout (whenever that happens).
Well, two things:
- when using mod_dav, you can use "Require group" and have that group
defined in ldap. But this is not for controlling svn's per-directory
commit access
- we use a modified version of svnperms.py (the one that comes with subversion
itself), that will be submitted upstream, that uses groups defined in LDAP. So
the following works in svnperms.conf:
[global]
permissions-source = ldap
[ldap]
host = localhost
basedn = ou=Group,dc=example,dc=com
groups-filter-format = (&(objectClass=groupOfNames)(member=uid=$user,ou=People,dc=example,dc=com))
groups-name-attribute = cn
(...)
[repo-name]
/updates/[^/]+/kernel-2.6/.* = *() @kernel(add,remove,update) @updates(add,remove,update) @svnadmin(add,remove,update)
(...)
In this case, the kernel, updates and svnadmin groups are defined in
LDAP and consulted via that query. Only the ACLs themselves are still in
the conf file. The group definition in LDAP is a standard groupOfNames
entry in our case, but the query is configurable enough (we hope) so you
can use any type of entry.
This version of svnperms can be obtained here:
http://svn.mandriva.com/cgi-bin/viewvc.cgi/soft/build_system/svnperms/trunk/
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: What are the benefits of using LDAP to authenticate users to SVN
Posted by Andy Levy <an...@gmail.com>.
On 6/14/07, Andreas Hasenack <an...@mandriva.com.br> wrote:
> On Thu, Jun 14, 2007 at 06:14:46PM +0530, nikhil gupta wrote:
> > Hi Andy,
> >
> > Thanks for the reply...
> >
> > But the benefits that you mentioned can also be achieved using the
> > SSPI authentication, AFAIK. Are there any additional benefits that
> > LDAP provides over SSPI?
>
> LDAP is not just authentication: you can store groups there, for
> example, and use it as a source of authorizarion.
You mean one can use LDAP groups in conjunction w/ SVN's per-directory
authorization? Got a link? I need to figure out how to do exactly that
for our next big SVN rollout (whenever that happens).
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org