You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by David Weintraub <qa...@gmail.com> on 2011/09/06 17:12:41 UTC
Setting up Jenkins and Subversion for multiple LDAP domains.
This is really part of the same question, but it involves both our
Subversion repository and Jenkins.
We want to use our Windows Active Directory to log into Jenkins and as
our permissioning scheme in Subversion. Subversion uses Apache httpd.
First in Subversion: We have the following setup for the "mfxdomain":
<Location /src>
DAV svn
SVNParentPath /opt/cm/svn_repos
AuthType basic
AuthName "MFX Repository"
AuthBasicProvider ldap
AuthzLDAPAuthoritative off
AuthLDAPURL
"ldap://mfxdomain.mycompany.com:3268/dc=mycompany,dc=com?sAMAccountName"
NONE
AuthLDAPBindDN "CN=svnuser,OU=Users,DC=mycompany,DC=com"
AuthLDAPBindPassword "swordfish"
Require valid-user
</Location>
This works great. Anyone in the mfxdomain is able to log in. However,
many of our users are actually in the effdomain, so we need to verify
a user is either in one of the two domains. How do I set this up? Do I
need a new <location>, or do I double the AuthLDAP lines?
In Jenkins, we use the active directory plugin to verify our logins.
Is it possible to specify two Active Directory domains?
And in both, how do I know if someone is in one domain or the other?
Do they need to prefix their login with the domain?
--
David Weintraub
qazwart@gmail.com
Re: Setting up Jenkins and Subversion for multiple LDAP domains.
Posted by David Weintraub <qa...@gmail.com>.
On Tue, Sep 6, 2011 at 11:50 AM, Daniel Shahaf <d....@daniel.shahaf.name> wrote:
>> And in both, how do I know if someone is in one domain or the other?
>> Do they need to prefix their login with the domain?
>>
>
> Why do you need to know that?
There might be two different users with the same id in each domain.
For example, there could be a jsmith in the mfxdomain and a jsmith in
the effhdomain. If jsmith from effhdomian signed in, how would it know
whether it was jsmith of the effhdomain that signed in, or jsmith of
the mfxdomain that signed in with an incorrect password?
This issue has been solved now because I've decided that anyone who
needs any of the CM tools needs to be in the mfxdomain. The developers
in the other domain will now have accounts in the mfxdomain and their
desktops will be moved to the mfxdomain. The two domains were suppose
to have been merged a couple of years ago, but no one pushed it. Now,
it's being pushed.
Thank you for your help.
--
David Weintraub
qazwart@gmail.com
Re: Setting up Jenkins and Subversion for multiple LDAP domains.
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
David Weintraub wrote on Tue, Sep 06, 2011 at 11:12:41 -0400:
> This is really part of the same question, but it involves both our
> Subversion repository and Jenkins.
>
> We want to use our Windows Active Directory to log into Jenkins and as
> our permissioning scheme in Subversion. Subversion uses Apache httpd.
>
> First in Subversion: We have the following setup for the "mfxdomain":
>
> <Location /src>
> DAV svn
> SVNParentPath /opt/cm/svn_repos
> AuthType basic
> AuthName "MFX Repository"
> AuthBasicProvider ldap
> AuthzLDAPAuthoritative off
> AuthLDAPURL
> "ldap://mfxdomain.mycompany.com:3268/dc=mycompany,dc=com?sAMAccountName"
> NONE
> AuthLDAPBindDN "CN=svnuser,OU=Users,DC=mycompany,DC=com"
> AuthLDAPBindPassword "swordfish"
> Require valid-user
> </Location>
>
> This works great. Anyone in the mfxdomain is able to log in. However,
> many of our users are actually in the effdomain, so we need to verify
> a user is either in one of the two domains. How do I set this up? Do I
> need a new <location>, or do I double the AuthLDAP lines?
>
AIUI httpd 2.3.x is required in order to be able to say 'Either <this>
LDAP group or <that> LDAP group' in authz settings. (We ran into this
at ASF infra). With 2.2 you might have to use separate <Location>s.
> And in both, how do I know if someone is in one domain or the other?
> Do they need to prefix their login with the domain?
>
Why do you need to know that?
> --
> David Weintraub
> qazwart@gmail.com
Betr.: Setting up Jenkins and Subversion for multiple LDAP domains.
Posted by Jan Keirse <ja...@tvh.be>.
David Weintraub <qa...@gmail.com> schreef op 06/09/2011 17:12:41:
> This is really part of the same question, but it involves both our
> Subversion repository and Jenkins.
>
> We want to use our Windows Active Directory to log into Jenkins and as
> our permissioning scheme in Subversion. Subversion uses Apache httpd.
>
> First in Subversion: We have the following setup for the "mfxdomain":
>
> <Location /src>
> DAV svn
> SVNParentPath /opt/cm/svn_repos
> AuthType basic
> AuthName "MFX Repository"
> AuthBasicProvider ldap
> AuthzLDAPAuthoritative off
> AuthLDAPURL
> "ldap://mfxdomain.mycompany.com:3268/dc=mycompany,dc=com?sAMAccountName"
> NONE
> AuthLDAPBindDN "CN=svnuser,OU=Users,DC=mycompany,DC=com"
> AuthLDAPBindPassword "swordfish"
> Require valid-user
> </Location>
>
> This works great. Anyone in the mfxdomain is able to log in. However,
> many of our users are actually in the effdomain, so we need to verify
> a user is either in one of the two domains. How do I set this up? Do I
> need a new <location>, or do I double the AuthLDAP lines?
>
> In Jenkins, we use the active directory plugin to verify our logins.
> Is it possible to specify two Active Directory domains?
>
>From my apache httpd.conf:
...
LoadModule authn_alias_module modules/mod_authn_alias.so
...
<AuthnProviderAlias ldap olddomain>
AuthLDAPURL "..." NONE
AuthLDAPBindDN "..."
AuthLDAPBindPassword "..."
</AuthnProviderAlias>
<AuthnProviderAlias ldap newdomain>
AuthLDAPURL "..." NONE
AuthLDAPBindDN "..."
AuthLDAPBindPassword "..."
</AuthnProviderAlias>
<Location /svn>
DAV svn
SVNParentPath C:/Repositories
AuthType Basic
AuthName "My Subversion server"
AuthBasicProvider newdomain olddomain
AuthzLDAPAuthoritative off
AuthzSVNAccessFile c:/repositories/authz
AuthzForceUsernameCase lower
SVNIndexXSLT /svn.xsl
require valid-user
</Location>
> And in both, how do I know if someone is in one domain or the other?
> Do they need to prefix their login with the domain?
I have no idea about that.
Kind Regards,
JAN KEIRSE
ICT-DEPARTMENT
Software quality & Systems: Software Engineer
**** DISCLAIMER ****
http://www.tvh.com/newen2/emaildisclaimer/default.html
"This message is delivered to all addressees subject to the conditions
set forth in the attached disclaimer, which is an integral part of this
message."