You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Ben Johnson <be...@indietorrent.org> on 2012/08/14 23:30:49 UTC
[users@httpd] Apache authentication - require group AND (not OR) user
Hello,
I've scoured the Internet for examples of how to implement logical
operators where the "require" directive is concerned.
The dearth of documentation and discussion regarding this subject leads
me to believe that it has not been implemented, or was implemented at
one time and then removed.
This is the most thorough discussion I can find on the subject, which
dead-ends:
http://www.mombu.com/programming/linux/t-apache-22-both-require-user-and-require-group-739013.html
My location block, which, at present, only allows one group
("programmers"), looks something like this:
<Location /svn/project>
AuthType Basic
AuthName "SVN Repository"
AuthBasicProvider dbm
AuthDBMType DB
AuthDBMUserFile "/var/www/apache-users"
AuthDBMGroupFile "/var/www/apache-users"
require group programmers
DAV svn
AuthzSVNAccessFile /var/www/projects/svn-access-control.cfg
SVNPath /var/www/svn/project
</Location>
Ideally, I wish to do something like the following (I'm using
pseudo-code here, because it's probably easier to understand than plain
English):
if ($group === 'programmers' || ($group === 'clients && $user === 'joe')) {
//Allow access.
}
else {
//Deny access.
}
Is this possible? Or do I need to give-up on controlling authentication
at this level and instead focus on authorization within
"svn-access-control.cfg"?
Thanks for any help!
-Ben
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache authentication - require group AND (not
OR) user
Posted by Ben Johnson <be...@indietorrent.org>.
On 8/23/2012 1:12 PM, Ben Johnson wrote:
>
>
> On 8/22/2012 3:48 PM, Ben Johnson wrote:
>>
>>
>> On 8/22/2012 2:39 PM, Eric Covener wrote:
>>>> http://www.svnforum.org/threads/37237-AuthzSVNAccessFile-Require-ldap-group
>>>
>>> That thread predates the authorization containers from 2.4 recommended
>>> in this thread. Maybe there are plans for AuthzSVN to interoperate,
>>> or maybe it already does.
>>
>> Thanks, Eric. Your attention to detail is much appreciated.
>>
>> I didn't notice that these containers were introduced in a version later
>> than the one I'm using (I'm using 2.2.14 and they were introduced in
>> 2.3). No wonder they didn't work as expected. Shame on me.
>>
>> I'll set-up a VM with the required version and see if it makes a difference.
>>
>> And, of course, I'll report my findings to the list.
>>
>> If in the meantime somebody reads this and believes that
>> interoperability between the two modules was introduced with 2.3 or
>> later, please do speak-up. :)
>>
>> Thanks again,
>>
>> -Ben
>
> I need a stop-gap solution until I have a chance to test the new
> authorization containers in Apache >= 2.3 and see if they "play nicely"
> with AuthzSVN.
>
> So, it's back to using simply "Require valid-user" in the
> <Location></Location> block and handling everything else in the
> AuthzSVNAccessFile.
>
> One "problem" I've noticed is that when a user who does not have any
> access to the repository via the AuthzSVNAccessFile, but who does meet
> "Require valid-user" requirement, attempts to access this <Location>,
> Apache gets stuck in a redirect loop, logging the following with each
> request until the user-agent (browser) puts a stop to it:
>
> Access denied: 'user' GET repo:/
>
> The Apache configuration directives are:
>
> --------------------
> <Location /svn/repo>
> AuthType Basic
> AuthName "SVN Repository"
> AuthBasicProvider dbm
> AuthDBMType DB
> AuthDBMUserFile "/var/www/apache-users"
> AuthDBMGroupFile "/var/www/apache-users"
> Require valid-user
> DAV svn
> AuthzSVNAccessFile /var/www/projects/svn-access-control-v2.cfg
> SVNPath /var/www/svn/repo
> </Location>
> --------------------
>
> The AuthzSVNAccessFile contents are:
>
> --------------------
> [groups]
> admins = joe
> programmers = john, sam, sally
> clients = larry
>
> [/]
> @admins = rw
> @programmers = r
> @clients = r
> --------------------
>
> If I authenticate as "joe", for example, I am able to navigate the
> repository without issue.
>
> But, if I authenticate as a user does not appear anywhere in the
> AuthzSVNAccessFile, I am hit with the infinite redirect loop.
>
> Am I doing something silly? Or is this a known issue (perhaps one that's
> been fixed)?
>
> Thanks for any help!
>
> -Ben
>
I finally resolved the redirection loop with the help of this post:
http://stackoverflow.com/questions/264676/how-to-enable-mod-dav-svn-in-the-root-directory-of-a-named-virtual-host
.
In particular, yurique's comment:
"Found this in /etc/apache2/conf.d/subversion.conf (need to map error
documents to defaults)".
This resolved the problem for me, given my configuration:
<LocationMatch ^/svn>
ErrorDocument 400 default
ErrorDocument 401 default
ErrorDocument 403 default
ErrorDocument 404 default
ErrorDocument 405 default
ErrorDocument 408 default
ErrorDocument 410 default
ErrorDocument 411 default
ErrorDocument 412 default
ErrorDocument 413 default
ErrorDocument 414 default
ErrorDocument 415 default
ErrorDocument 500 default
ErrorDocument 501 default
ErrorDocument 502 default
ErrorDocument 503 default
</LocationMatch>
I didn't mention that I had the following line in my
<Location></Location> block (because it didn't seem relevant at the time):
<Location /svn/repo>
[...]
SSLOptions +StrictRequire
SSLRequireSSL
ErrorDocument 403 https://example.com/svn/repo/
[...]
</Location>
The intention here was to FORCE access over SSL, while at the same time
eliminating the "double-login problem" and mitigating the potential for
users to expose their credentials over a plaintext connection.
In hindsight, it makes sense that the ErrorDocument directive was
causing a loop.
The unfortunate consequence of "fixing" this is that users will no
longer be asked for credentials when attempting the access the
repository over a plaintext connection. Instead, they'll simply receive
a "403 Forbidden" response.
I'm on Apache 2.2, so I can't try something like the following (because
conditional logic requires Apache >= 2.3); I have no idea if it would
work, anyway:
<Location /svn/repo>
[...]
SSLOptions +StrictRequire
SSLRequireSSL
<If "%{HTTPS} == 'off'">
ErrorDocument 403 https://example.com/svn/repo/
</If>
[...]
</Location>
Just thought I'd share the solution to the loop issue.
-Ben
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache authentication - require group AND (not
OR) user
Posted by Ben Johnson <be...@indietorrent.org>.
On 8/22/2012 3:48 PM, Ben Johnson wrote:
>
>
> On 8/22/2012 2:39 PM, Eric Covener wrote:
>>> http://www.svnforum.org/threads/37237-AuthzSVNAccessFile-Require-ldap-group
>>
>> That thread predates the authorization containers from 2.4 recommended
>> in this thread. Maybe there are plans for AuthzSVN to interoperate,
>> or maybe it already does.
>
> Thanks, Eric. Your attention to detail is much appreciated.
>
> I didn't notice that these containers were introduced in a version later
> than the one I'm using (I'm using 2.2.14 and they were introduced in
> 2.3). No wonder they didn't work as expected. Shame on me.
>
> I'll set-up a VM with the required version and see if it makes a difference.
>
> And, of course, I'll report my findings to the list.
>
> If in the meantime somebody reads this and believes that
> interoperability between the two modules was introduced with 2.3 or
> later, please do speak-up. :)
>
> Thanks again,
>
> -Ben
I need a stop-gap solution until I have a chance to test the new
authorization containers in Apache >= 2.3 and see if they "play nicely"
with AuthzSVN.
So, it's back to using simply "Require valid-user" in the
<Location></Location> block and handling everything else in the
AuthzSVNAccessFile.
One "problem" I've noticed is that when a user who does not have any
access to the repository via the AuthzSVNAccessFile, but who does meet
"Require valid-user" requirement, attempts to access this <Location>,
Apache gets stuck in a redirect loop, logging the following with each
request until the user-agent (browser) puts a stop to it:
Access denied: 'user' GET repo:/
The Apache configuration directives are:
--------------------
<Location /svn/repo>
AuthType Basic
AuthName "SVN Repository"
AuthBasicProvider dbm
AuthDBMType DB
AuthDBMUserFile "/var/www/apache-users"
AuthDBMGroupFile "/var/www/apache-users"
Require valid-user
DAV svn
AuthzSVNAccessFile /var/www/projects/svn-access-control-v2.cfg
SVNPath /var/www/svn/repo
</Location>
--------------------
The AuthzSVNAccessFile contents are:
--------------------
[groups]
admins = joe
programmers = john, sam, sally
clients = larry
[/]
@admins = rw
@programmers = r
@clients = r
--------------------
If I authenticate as "joe", for example, I am able to navigate the
repository without issue.
But, if I authenticate as a user does not appear anywhere in the
AuthzSVNAccessFile, I am hit with the infinite redirect loop.
Am I doing something silly? Or is this a known issue (perhaps one that's
been fixed)?
Thanks for any help!
-Ben
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache authentication - require group AND (not
OR) user
Posted by Ben Johnson <be...@indietorrent.org>.
On 8/22/2012 2:39 PM, Eric Covener wrote:
>> http://www.svnforum.org/threads/37237-AuthzSVNAccessFile-Require-ldap-group
>
> That thread predates the authorization containers from 2.4 recommended
> in this thread. Maybe there are plans for AuthzSVN to interoperate,
> or maybe it already does.
Thanks, Eric. Your attention to detail is much appreciated.
I didn't notice that these containers were introduced in a version later
than the one I'm using (I'm using 2.2.14 and they were introduced in
2.3). No wonder they didn't work as expected. Shame on me.
I'll set-up a VM with the required version and see if it makes a difference.
And, of course, I'll report my findings to the list.
If in the meantime somebody reads this and believes that
interoperability between the two modules was introduced with 2.3 or
later, please do speak-up. :)
Thanks again,
-Ben
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache authentication - require group AND (not OR) user
Posted by Eric Covener <co...@gmail.com>.
> http://www.svnforum.org/threads/37237-AuthzSVNAccessFile-Require-ldap-group
That thread predates the authorization containers from 2.4 recommended
in this thread. Maybe there are plans for AuthzSVN to interoperate,
or maybe it already does.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache authentication - require group AND (not
OR) user
Posted by Ben Johnson <be...@indietorrent.org>.
On 8/16/2012 11:28 AM, Ben Johnson wrote:
>
>
>> On 8/15/2012 7:45 AM, Rainer Jung wrote:
>> You might be looking for the RequireAny and RequireAll container
>> directives:
>>
>> http://httpd.apache.org/docs/2.4/en/mod/mod_authz_core.html#requireall
>>
>> See also
>>
>> httpd.apache.org/docs/2.4/en/mod/mod_authz_core.html#requireall
>>
>> and finally the How To
>>
>> http://httpd.apache.org/docs/2.4/en/howto/auth.html
>>
>> Regards,
>>
>> Rainer
>
> Thanks, Rainer! This is exactly what I was looking for: the ability to
> implement complex authorization containers.
>
> That said, as I explained in my reply to Hugh (on this same subject), it
> seems that the AuthzSVN module (and the directives defined in
> AuthzSVNAccessFile) is taking precedence over Basic authorization
> module. I found the following excerpt at
> http://www.csparks.com/Subversion.xhtml :
>
> "The Satisfy Any directive tells Apache to allow access if either the
> Allow directive is satisfied or one of the Auth modules is satified. The
> "Allow from all" is always satisfied. But we have two Auth modules:
> AuthzSVN and AuthDigest. In this case AuthzSVN will look into the
> svnusers.conf file. If no user name is required for the requested
> resource, no prompt for authentication will occur. But if a username is
> required, the AuthDigest module will come into play and prompt for
> credentials. The authorized name is allowed to do whatever the
> AuthzSVNAccessFile permits."
>
> This statement seems consistent with the observed behavior. And it bears
> mention that in my example directives (and those at the above-cited
> resource), "require" directives come before the "AuthzSVNAccessFile"
> directive, which seems to indicate that the order is irrelevant.
>
> Do you have any experience or advice in this regard?
>
> Basically, I am trying to determine how much of the access control
> should be done in the <Location></Location> block and how much of it
> should be done in the AuthzSVNAccessFile. My primary concern is that we
> have dozens of SVN repositories and I don't want to have to define the
> "[groups]" for every single repository when the groups are the same for
> all of them.
I should add that I don't want to have to define every single
repository, and permissions for their attendant paths, in the
AuthzSVNAccessFile, either.
> In fact, I would prefer to use a single AuthzSVNAccessFile that has some
> very basic rules and handle all other aspects of access control in the
> Location blocks in which each repository is defined.
>
> Does this make any sense at all?
After more digging, I realize that I'm not the only one who has raised
this issue:
http://www.svnforum.org/threads/37237-AuthzSVNAccessFile-Require-ldap-group
To quote "Tubaman":
"However, it still seems a shame that the Require ldap-group directive
cannot be usefully used to restrict valid users in conjunction with a
more permissive AuthzSVNAccessFile (which knows nothing about the LDAP
groups). Does anyone know if some sort of priority setting is planned
for future releases that would enable this behaviour? Or is it actually
a bug or feature that could be mentioned in the documentation?"
This statement, and the lack of a response, confirms that it is not
possible to implement meaningful authentication requirements, via the
"Require" family of configuration directives, when at the same time
using the AuthzSVNAccessFile directive.
This fact is disappointing, but perfectly understandable, given the
complexity of these systems.
I just wanted to be sure that my request wasn't possible before
accepting that there will be redundancy across numerous
AuthzSVNAccessFile files.
> Thanks again,
>
> -Ben
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache authentication - require group AND (not
OR) user
Posted by Ben Johnson <be...@indietorrent.org>.
On 8/15/2012 7:45 AM, Rainer Jung wrote:
> On 14.08.2012 23:30, Ben Johnson wrote:
>> Hello,
>>
>> I've scoured the Internet for examples of how to implement logical
>> operators where the "require" directive is concerned.
>>
>> The dearth of documentation and discussion regarding this subject leads
>> me to believe that it has not been implemented, or was implemented at
>> one time and then removed.
>>
>> This is the most thorough discussion I can find on the subject, which
>> dead-ends:
>> http://www.mombu.com/programming/linux/t-apache-22-both-require-user-and-require-group-739013.html
>>
>>
>> My location block, which, at present, only allows one group
>> ("programmers"), looks something like this:
>>
>> <Location /svn/project>
>> AuthType Basic
>> AuthName "SVN Repository"
>> AuthBasicProvider dbm
>> AuthDBMType DB
>> AuthDBMUserFile "/var/www/apache-users"
>> AuthDBMGroupFile "/var/www/apache-users"
>> require group programmers
>> DAV svn
>> AuthzSVNAccessFile /var/www/projects/svn-access-control.cfg
>> SVNPath /var/www/svn/project
>> </Location>
>>
>> Ideally, I wish to do something like the following (I'm using
>> pseudo-code here, because it's probably easier to understand than plain
>> English):
>>
>> if ($group === 'programmers' || ($group === 'clients && $user ===
>> 'joe')) {
>> //Allow access.
>> }
>> else {
>> //Deny access.
>> }
>>
>> Is this possible? Or do I need to give-up on controlling authentication
>> at this level and instead focus on authorization within
>> "svn-access-control.cfg"?
>>
>> Thanks for any help!
>
> You might be looking for the RequireAny and RequireAll container
> directives:
>
> http://httpd.apache.org/docs/2.4/en/mod/mod_authz_core.html#requireall
>
> See also
>
> httpd.apache.org/docs/2.4/en/mod/mod_authz_core.html#requireall
>
> and finally the How To
>
> http://httpd.apache.org/docs/2.4/en/howto/auth.html
>
> Regards,
>
> Rainer
Thanks, Rainer! This is exactly what I was looking for: the ability to
implement complex authorization containers.
That said, as I explained in my reply to Hugh (on this same subject), it
seems that the AuthzSVN module (and the directives defined in
AuthzSVNAccessFile) is taking precedence over Basic authorization
module. I found the following excerpt at
http://www.csparks.com/Subversion.xhtml :
"The Satisfy Any directive tells Apache to allow access if either the
Allow directive is satisfied or one of the Auth modules is satified. The
"Allow from all" is always satisfied. But we have two Auth modules:
AuthzSVN and AuthDigest. In this case AuthzSVN will look into the
svnusers.conf file. If no user name is required for the requested
resource, no prompt for authentication will occur. But if a username is
required, the AuthDigest module will come into play and prompt for
credentials. The authorized name is allowed to do whatever the
AuthzSVNAccessFile permits."
This statement seems consistent with the observed behavior. And it bears
mention that in my example directives (and those at the above-cited
resource), "require" directives come before the "AuthzSVNAccessFile"
directive, which seems to indicate that the order is irrelevant.
Do you have any experience or advice in this regard?
Basically, I am trying to determine how much of the access control
should be done in the <Location></Location> block and how much of it
should be done in the AuthzSVNAccessFile. My primary concern is that we
have dozens of SVN repositories and I don't want to have to define the
"[groups]" for every single repository when the groups are the same for
all of them.
In fact, I would prefer to use a single AuthzSVNAccessFile that has some
very basic rules and handle all other aspects of access control in the
Location blocks in which each repository is defined.
Does this make any sense at all?
Thanks again,
-Ben
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache authentication - require group AND (not
OR) user
Posted by Rainer Jung <ra...@kippdata.de>.
On 14.08.2012 23:30, Ben Johnson wrote:
> Hello,
>
> I've scoured the Internet for examples of how to implement logical
> operators where the "require" directive is concerned.
>
> The dearth of documentation and discussion regarding this subject leads
> me to believe that it has not been implemented, or was implemented at
> one time and then removed.
>
> This is the most thorough discussion I can find on the subject, which
> dead-ends:
> http://www.mombu.com/programming/linux/t-apache-22-both-require-user-and-require-group-739013.html
>
> My location block, which, at present, only allows one group
> ("programmers"), looks something like this:
>
> <Location /svn/project>
> AuthType Basic
> AuthName "SVN Repository"
> AuthBasicProvider dbm
> AuthDBMType DB
> AuthDBMUserFile "/var/www/apache-users"
> AuthDBMGroupFile "/var/www/apache-users"
> require group programmers
> DAV svn
> AuthzSVNAccessFile /var/www/projects/svn-access-control.cfg
> SVNPath /var/www/svn/project
> </Location>
>
> Ideally, I wish to do something like the following (I'm using
> pseudo-code here, because it's probably easier to understand than plain
> English):
>
> if ($group === 'programmers' || ($group === 'clients && $user === 'joe')) {
> //Allow access.
> }
> else {
> //Deny access.
> }
>
> Is this possible? Or do I need to give-up on controlling authentication
> at this level and instead focus on authorization within
> "svn-access-control.cfg"?
>
> Thanks for any help!
You might be looking for the RequireAny and RequireAll container directives:
http://httpd.apache.org/docs/2.4/en/mod/mod_authz_core.html#requireall
See also
httpd.apache.org/docs/2.4/en/mod/mod_authz_core.html#requireall
and finally the How To
http://httpd.apache.org/docs/2.4/en/howto/auth.html
Regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org