You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@subversion.apache.org by Engebakken Geir <ge...@edb.com> on 2010/11/30 14:19:13 UTC

RE: SVN Path Authorization

I had the same problem when I set up SVN1.5.x  (way back then). Could not get arounf the fact that users needed R-access to root of repos, so I ended up with something like the following to prevent users from having R-access to entire repos.:


[repo:/]
@admin = rw
*=r


[repo:/projects/Project1/subProject1]
@project1_subproject1Developers = rw
~project1_subproject1Developers =


The ~ is a negation, meaning "all users not in the group"




Geir

Note : All inquiries regarding Subversion, MKS and general Development servers should be directed to "EDB SourceControl System"

From: Joseph Isenberg [mailto:jisenberg@gmail.com]
Sent: 27. oktober 2010 16:19
To: users@subversion.apache.org
Subject: SVN Path Authorization

Can I set up an AuthZSVNAccessFile that doesn't allow read to the root, but does allow read an read/write to sub-paths. I want something like this:

[repo:/]
@admin = rw

[repo:/projects/Project1]
@project1_admin = rw

[repo:/projects/Project1/subProject1]
@project1_subproject1Developers = rw

I would then give the devs the url to the subproject and they could check that out. I'm pretty sure I've done something like this in the past, but now it won't let me check out unless I have read access to the parent paths.

Thanks for any help.
Joseph Isenberg

RE: SVN Path Authorization

Posted by Ramesh Nadupalli <na...@gmail.com>.

Thanks Jamie. I didn't know it's already available, very useful...

I will take up the rest with you privately. 

-----Original Message-----
From: JamieEchlin [mailto:jamie.echlin@credit-suisse.com] 
Sent: Thursday, December 02, 2010 4:24 AM
To: users@subversion.apache.org
Subject: RE: SVN Path Authorization




Ramesh Nadupalli wrote:
> 
> What are the other characters supported in the apache authorization 
> file (AuthzSVNAccessFile)?  Any documentation available?
> 
> In case if there are any human errors in the authorization file, its 
> making repository unavailable. Is there a tool/mechanism to check the 
> access configurations before restarting the apache?
> 
> For ex: without having a group, granting access to a directory will 
> break the repository access.
> 

Ramesh, you can use the program svnauthz-validate for this. It's not
distributed in every distro, if you don't have it then it needs to be built
from source.

We're currently added that to the pre-commit hook... (if you're the Ramesh
that I think you are).

cheers, jamie
--
View this message in context:
http://old.nabble.com/SVN-Path-Authorization-tp30068129p30356900.html
Sent from the Subversion Users mailing list archive at Nabble.com.

RE: SVN Path Authorization

Posted by JamieEchlin <ja...@credit-suisse.com>.



Ramesh Nadupalli wrote:
> 
> What are the other characters supported in the apache authorization file
> (AuthzSVNAccessFile)?  Any documentation available? 
> 
> In case if there are any human errors in the authorization file, its
> making
> repository unavailable. Is there a tool/mechanism to check the access
> configurations before restarting the apache? 
> 
> For ex: without having a group, granting access to a directory will break
> the repository access. 
> 

Ramesh, you can use the program svnauthz-validate for this. It's not
distributed in every distro, if you don't have it then it needs to be built
from source.

We're currently added that to the pre-commit hook... (if you're the Ramesh
that I think you are).

cheers, jamie
-- 
View this message in context: http://old.nabble.com/SVN-Path-Authorization-tp30068129p30356900.html
Sent from the Subversion Users mailing list archive at Nabble.com.

RE: SVN Path Authorization

Posted by Ramesh Nadupalli <na...@gmail.com>.

What are the other characters supported in the apache authorization file
(AuthzSVNAccessFile)?  Any documentation available? 

In case if there are any human errors in the authorization file, its making
repository unavailable. Is there a tool/mechanism to check the access
configurations before restarting the apache? 

 

For ex: without having a group, granting access to a directory will break
the repository access. 

 

Thanks

Ramesh

From: Engebakken Geir [mailto:geir.engebakken@edb.com] 
Sent: Tuesday, November 30, 2010 9:19 AM
To: Joseph Isenberg; users@subversion.apache.org
Subject: RE: SVN Path Authorization

 

I had the same problem when I set up SVN1.5.x  (way back then). Could not
get arounf the fact that users needed R-access to root of repos, so I ended
up with something like the following to prevent users from having R-access
to entire repos.:

 

 

[repo:/]

@admin = rw

*=r

 

 

[repo:/projects/Project1/subProject1]

@project1_subproject1Developers = rw

~project1_subproject1Developers = 

 

 

The ~ is a negation, meaning "all users not in the group"

 

 

 

 

Geir

 

Note : All inquiries regarding Subversion, MKS and general Development
servers should be directed to "EDB SourceControl System"

 

From: Joseph Isenberg [mailto:jisenberg@gmail.com] 
Sent: 27. oktober 2010 16:19
To: users@subversion.apache.org
Subject: SVN Path Authorization

 

Can I set up an AuthZSVNAccessFile that doesn't allow read to the root, but
does allow read an read/write to sub-paths. I want something like this:

 

[repo:/]

@admin = rw

 

[repo:/projects/Project1]

@project1_admin = rw

 

[repo:/projects/Project1/subProject1]

@project1_subproject1Developers = rw

 

I would then give the devs the url to the subproject and they could check
that out. I'm pretty sure I've done something like this in the past, but now
it won't let me check out unless I have read access to the parent paths.

 

Thanks for any help.

Joseph Isenberg

RE: SVN Path Authorization

Posted by Engebakken Geir <ge...@edb.com>.

Well, this was exactly what did not work for us because all users needed R access to /. Did you test and verify that it works?



Geir

Note : All inquiries regarding Subversion, MKS and general Development servers should be directed to "EDB SourceControl System"

From: ankush chadha [mailto:ankushchadha2003@yahoo.com]
Sent: 30. november 2010 15:36
To: Engebakken Geir; Joseph Isenberg; users@subversion.apache.org
Subject: Re: SVN Path Authorization


 [/]
*=
@Developers=rw

[/trunk/modules/moduleA/tests]
@QA=rw

Here QA group has rw access only to tests folder and nothing else.


Ankush


________________________________
From: Engebakken Geir <ge...@edb.com>
To: Joseph Isenberg <ji...@gmail.com>; "users@subversion.apache.org" <us...@subversion.apache.org>
Sent: Tue, November 30, 2010 9:19:13 AM
Subject: RE: SVN Path Authorization
I had the same problem when I set up SVN1.5.x  (way back then). Could not get arounf the fact that users needed R-access to root of repos, so I ended up with something like the following to prevent users from having R-access to entire repos.:


[repo:/]
@admin = rw
*=r


[repo:/projects/Project1/subProject1]
@project1_subproject1Developers = rw
~project1_subproject1Developers =


The ~ is a negation, meaning “all users not in the group”




Geir

Note : All inquiries regarding Subversion, MKS and general Development servers should be directed to "EDB SourceControl System"

From: Joseph Isenberg [mailto:jisenberg@gmail.com]
Sent: 27. oktober 2010 16:19
To: users@subversion.apache.org
Subject: SVN Path Authorization

Can I set up an AuthZSVNAccessFile that doesn't allow read to the root, but does allow read an read/write to sub-paths. I want something like this:

[repo:/]
@admin = rw

[repo:/projects/Project1]
@project1_admin = rw

[repo:/projects/Project1/subProject1]
@project1_subproject1Developers = rw

I would then give the devs the url to the subproject and they could check that out. I'm pretty sure I've done something like this in the past, but now it won't let me check out unless I have read access to the parent paths.

Thanks for any help.
Joseph Isenberg