Home / server / Questions / 293580
Accepted
Yaakov Ellis
Asked: 2011-07-25 10:36:14 +0800 CST

Restrict WebSVN Access to Windows Users in Specific Domain

  • 772

I am trying to install WebSVN on top of a VisualSVN install. VisualSVN is set up to use windows authentication, with users from domains CLIENT and DEV getting access to different areas of the site. Users in CLIENT are denied root access (through the SVN interface) and are given access to specific paths in the repository. Users in DEV are given access to everything. This works fine when accessing VisualSVN through its web interface or through the TortoiseSVN repo browser.

I am able to get WebSVN to run, and it authenticates that valid domain user credentials (from either of the domains) are provided before granting access. However, once valid credentials are provided, it gives access to everything, to all users.

I have tried different setup variations in the VisualSVN/conf/httpd-custom.conf file, but none of them work to solve this problem. Ideally, WebSVN would give the identical access as VisualSVN. However, I am ok with blocking all CLIENT domain users entirely from accessing WebSVN.

The current state of the conf file is:

LoadModule php5_module "c:/php/php5apache2_2.dll"
LoadModule authz_user_module bin/mod_authz_user.so
LoadModule sspi_auth_module bin/mod_auth_sspi.so
AddType application/x-httpd-php .php
AddType application/x-httpd-php .php3 

PHPIniDir "C:/php"

<IfModule dir_module>
   DirectoryIndex index.html index.php 
</IfModule>

<Location /websvn/>  
  SVNListParentPath on
  SVNParentPath "D:/Repositories/"  

  AuthName "SVN Server"
  AuthType SSPI
  SSPIAuth On
  SSPIAuthoritative On
  SSPIDomain DEV

  require valid-user
</Location>

(This setup is aimed at only allowing access to members of the DEV domain, implicitly excluding the CLIENT domain - however, solutions to either approach will be welcome and accepted).

apache-2.2 svn visualsvn-server httpd.conf mod-auth

1 Answers

  1. Best Answer

    Here is how I eventually got it to restrict users to those who are in a specific domain:

    <Location /websvn/> 
  AuthName "SVN Server"
  AuthType SSPI
  SSPIAuth On
  SSPIAuthoritative On
  SSPIDomain DEV
  SSPIOfferBasic On
  SSPIOmitDomain On

  require group DEV\Group1
  require group DEV\Group2
</Location>

    The key was to use the require group line to say which specific groups within the domain should be able to get access. The require valid-user line in my previous attempt was just validating that it was a valid user, but was not checking the domain of the user.

    • 1