My Notepad

  • My Linux Notes
  • My Grid Notes
  • To do List
  • Thursday, November 22, 2007

     

    Setup Subversion to authenticate agaist Active Directory

    Subversion server can be running on either Windows or Linux platform as both have good support to apache web server. One of the benefit for windows version of apache is, by default, most of the modules are already included when intially installed,so that we can avoid the hassle to re-configure, re-build apache from source. Note that apache2.2 has compatibility issue with Subversion, so make sure you are using apache 2.0.x.

    Two required apache modules are mod_auth_ldap.so and util_ldap.so, if u want per-repo authZ control, then mod_authz_svn.so will be required, which needs be copied from SVN installation directory together with mod_dav_so.

    Make sure you have modified your httpd.conf so that all these modules are loaded.

    Before test Subversion against AD, it's critical to make sure your AD works well as a LDAP server. Simply use any OpenLDAP client to test it, if using ldapsearch, type:

    ldapsearch -h hostname_of_AD_server -x -b "OU=SVN,OU=Accounts,DC=ms,DC=oerc,DC
    =ox,DC=ac,DC=uk" -D "CN=powergridSVN,OU=SVN,OU=Accounts,DC=ms,DC=oerc,DC=ox,DC=a
    c,DC=uk" -W

    After the AD is verified, it's time to setup SVN to authenticate against with AD.
    For the directory you want to protect with AD authentication, add following:

    DAV svn
    SVNPath d:/SVN/repositories/test
    AuthzSVNAccessFile "d:/SVN/config/svn-access.conf"
    AuthLDAPURL ldap://hostname:389/OU=SVN,OU=Accounts,DC=ms,DC=oerc,DC=ox,DC=ac,DC=uk?sAMAccountName?sub?(ObjectClass=user)
    AuthLDAPBindDN CN=powergridSVN,OU=SVN,OU=Accounts,DC=ms,DC=ox,DC=ac,DC=uk
    AuthLDAPBindPassword xxxxxxxxx
    AuthType Basic
    AuthName "xxxxx"

    Require valid-user


    For access file:
    [groups]
    developers = tesetSVN1

    [/]
    * = r
    [repo_name:/]
    @developers = rw

    Comments: Post a Comment



    << Home

    Archives

    December 2005   January 2006   February 2006   April 2006   May 2006   June 2006   July 2006   November 2006   February 2007   May 2007   June 2007   November 2007   February 2008   March 2008   April 2008   August 2008   December 2008   March 2009   April 2009   May 2009   June 2009   October 2009   November 2009   December 2009   May 2013  

    This page is powered by Blogger. Isn't yours?