You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by "Wesley J. Landaker" <wj...@icecavern.net> on 2006/10/20 22:49:24 UTC

Mapping Apache usernames -> subversion usernames

Hi folks,

Is there a way to map apache/kerberos usernames to a set of different 
subversion usernames? 

For example, I am using apache2 with mod_auth_kerb so usernames show up 
as "user@REALM.EXAMPLE.ORG".

This works, but causes a number of problems and general ugliness. For 
instance, it makes just about every script that uses the repository have to 
jump through hoops, and doesn't match up with the rest of the history from 
before when we used htpasswd auth. 

Since every user maps to user@example.org, and there only is one realm, I 
would like them to show up in subversion simply as "user". It seems like 
there has got to be a way[1] to do this easily, either via subversion or 
apache.

Any ideas? 

For reference, here the relevent apache config:

<Location /svn/XXX>
  DAV svn
  SVNPath /srv/svn/repos/XXX
  SSLRequireSSL
  AuthType Kerberos
  KrbAuthRealms REALM.EXAMPLE.ORG
  AuthName "XXX Subversion Repository"
  AuthzSVNAccessFile /srv/svn/repos/XXX/conf/authz.conf
</Location>

[1] Well, I know one way, which I will do if I have to: hack the source of 
either mod_auth_kerb or mod_dav_svn. ;) But that's not the "best" way.

-- 
Wesley J. Landaker <wj...@icecavern.net>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Mapping Apache usernames -> subversion usernames

Posted by Russ <rs...@istandfor.com>.
I would be interrestered in the solution as well.  I've finally gotten mod_auth_kerb and ran into the same problem with trac.  I was able to do some quick source hacking (thank god its written in python) and I was able to lowercase the usernames and get rid of the domain name in username.  It would be nice if I could do it as an apache configuration though.

Russ
Sent wirelessly via BlackBerry from T-Mobile.  

-----Original Message-----
From: "Wesley J. Landaker" <wj...@icecavern.net>
Date: Fri, 20 Oct 2006 16:49:24 
To:users@subversion.tigris.org
Subject:  Mapping Apache usernames -> subversion usernames

Hi folks,

Is there a way to map apache/kerberos usernames to a set of different 
subversion usernames? 

For example, I am using apache2 with mod_auth_kerb so usernames show up 
as "user@REALM.EXAMPLE.ORG".

This works, but causes a number of problems and general ugliness. For 
instance, it makes just about every script that uses the repository have to 
jump through hoops, and doesn't match up with the rest of the history from 
before when we used htpasswd auth. 

Since every user maps to user@example.org, and there only is one realm, I 
would like them to show up in subversion simply as "user". It seems like 
there has got to be a way[1] to do this easily, either via subversion or 
apache.

Any ideas? 

For reference, here the relevent apache config:

<Location /svn/XXX>
  DAV svn
  SVNPath /srv/svn/repos/XXX
  SSLRequireSSL
  AuthType Kerberos
  KrbAuthRealms REALM.EXAMPLE.ORG
  AuthName "XXX Subversion Repository"
  AuthzSVNAccessFile /srv/svn/repos/XXX/conf/authz.conf
</Location>

[1] Well, I know one way, which I will do if I have to: hack the source of 
either mod_auth_kerb or mod_dav_svn. ;) But that's not the "best" way.

-- 
Wesley J. Landaker <wj...@icecavern.net>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

[SOLVED] Re: Mapping Apache usernames -> subversion usernames

Posted by "Wesley J. Landaker" <wj...@icecavern.net>.
On Friday, 20 October 2006 16:49, Wesley J. Landaker wrote:
> For example, I am using apache2 with mod_auth_kerb so usernames show up
> as "user@REALM.EXAMPLE.ORG".
[...]
> Since every user maps to user@example.org, and there only is one realm, I
> would like them to show up in subversion simply as "user". It seems like
> there has got to be a way[1] to do this easily, either via subversion or
> apache.

Well, after messing around with mod_auth_kerb a little bit and looking at it's 
crazy code, I realized that it was going to be easiest to take another path:

Now I'm just using mod_auth_pam. I use the following apache config:

<Location /svn/XXX>
  DAV svn
  SVNPath /srv/svn/repos/XXX
  SSLRequireSSL
  AuthPAM_Enabled on
  AuthType Basic
  Require valid-user
  AuthName "XXX Subversion Repository"
  AuthzSVNAccessFile /srv/svn/repos/XXX/conf/authz.conf
</Location>

Since I do not have nor want actual local users on my system for every person 
accessing Subversion, I then use an apache2 pam config something like this:

auth    required      pam_krb5.so ignore_root
account required      pam_krb5.so

Anyway, maybe that will help if anyone else is trying to do something similar.

-- 
Wesley J. Landaker <wj...@icecavern.net>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org