Okay, so I ended up toying with subversion via WebDAV on SLES today (I know, I know .. it’s bloody Sunday). It wasn’t much of a hassle though, after reading this. Sure, I made a few errors at first (simply confused the logic behind “Location” and “Directory“), but after that plain subversion commits via WebDAV (thus utilizing Apache) worked fine.
For POC or as a hint to myself, here’s where and what I needed to add/change:
Add the following modules to APACHE_MODULES in /etc/sysconfig/apache2:
- dav_svn (dav_svn needs dav, thus the need to add it too)
- authnz_ldap (authnz_ldap needs ldap, so again we need that too!)
After that, we can add our repository (or our multi-repository folder) to /etc/apache2/conf.d/subversion.conf:
# Limit write permission to list of valid users.
<LimitExcept GET PROPFIND OPTIONS REPORT>
# Require SSL connection for password protection.
AuthName "Subversion repositories (Domänenzugangsdaten)"
# The authentification provider is mod_ldap
# mod_ldap is our *only* authentification provider for this!
# AD requires an authentication DN to access any records
AuthLDAPBindDN "CN=LDAP Subversion,OU=anon_accounts,OU=Users,DC=foobar,DC=org"
# The URL to search in
# Search the group membership in the specified group, otherwise it's gonna
# get searched at the binding DN's location
Require ldap-group CN=gr_subversion,OU=Groups,DC=foobar,DC=org
Now, as you can see, my goal was to not rely on a separate authorization database, but to use our already existing Active Directory at work. Generally this works just fine, but it didn’t. I tried various things, like trying another user, changing the group (as in the “require ldap-group“) as well as changing my own password. Zip.
All I got was this line in the error_log of Apache:
[warn] [client 10.0.0.148]  auth_ldap authenticate: user foo authentication failed; URI /svn/admin-scripts/!svn/act/71f2b65f-d050-0410-b33c-3b31fbb94a00 [ldap_search_ext_s() for user failed][Operations error]
Now, that itself does tell you what is happening, but not why. So again, I ended up googling till I found this:
The suggested step was to add “REFERRALS off” to /etc/ldap/ldap.conf. Surprise, the file don’t exist. Heck, there’s that one in /etc/ldap.conf. I did that, still zip.
Did I get the wrong file ? Absolutely.
/etc/ldap.conf is used by nsswitch and pam_ldap, but not by openldap2 (which is what Apache is using). So reading this comment, adding the line to /etc/openldap2/ldap.conf, and *kaching*! Works.