且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如何让 Subversion 使用 Linux 系统帐户进行​​身份验证?

更新时间:2023-12-03 11:05:04

好的!我做到了!我还以为很难找到答案!

我们必须告诉 Apache 使用外部身份验证提供程序",Apache 不会检查身份验证,而是将任务委托给外部身份验证器,在这种情况下,奇妙的 pwauth.

所以我为使其工作而采取的步骤是:

  1. 为 Apache2 和 pwauth 安装 Mod_Auth_External 模块

    sudo apt-get install libapache2-mod-authnz-external pwauth

  2. 为 Apache 启用新模块:sudo a2enmod authnz_external 在终端中.

  3. 配置我的 apache.conf(或者您可能有 httpd.conf)以添加外部验证器(基于 这篇文章):

    AddExternalAuth pwauth/usr/local/libexec/pwauthSetExternalAuthMethod pwauth 管道

  4. 编辑我的 /etc/apache2/mods-available/dav_svn.conf 以设置新的外部身份验证提供程序:

    ...AuthType 基本AuthName "Subversion 存储库"AuthBasicProvider 外部AuthExternal pwauth需要有效用户...

  5. 经过测试并运行良好!

I've set up a Ubuntu Server for Subversion with Apache/WebDAV interface to share repositories with other developers. My question is, how can I make Subversion use the linux system accounts for authentication? This would lead to very easy Subversion account management. Subversion with Apache/WebDAV is currently working with this configuration:

Contents of /etc/apache2/mods-available/dav_svn.conf:

<Location /svn>
  DAV svn
  SVNParentPath /home/svn
  SVNListParentPath On
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /etc/apache2/dav_svn.passwd
  Require valid-user
</Location>

I have tried changing AuthUserFile /etc/apache2/dav_svn.passwd with AuthUserFile /etc/shadow with no success. This makes the server to respond with a error 500 internal server error. It's logical, why the Web service should have access to system authentication file?

Thanks a lot in advance!

Ok! I did it! And I thought it would be very hard to find the answer!

We have to tell Apache to use an "external authentication provider", Apache won't be checking for authentication, but will delegate the task to an external authenticator, in this case, the marvellous pwauth.

So the steps I did to make it work was:

  1. Install Mod_Auth_External module for Apache2 and pwauth

    sudo apt-get install libapache2-mod-authnz-external pwauth
    

  2. Enabled the new module for Apache: sudo a2enmod authnz_external in terminal.

  3. Configured my apache.conf (or you may have httpd.conf) to add the external authenticator (based on this article):

    AddExternalAuth pwauth /usr/local/libexec/pwauth
    SetExternalAuthMethod pwauth pipe
    

  4. Edited my /etc/apache2/mods-available/dav_svn.conf to set the new external auth provider:

    ...
    AuthType Basic
    AuthName "Subversion Repository"
    AuthBasicProvider external
    AuthExternal pwauth
    Require valid-user
    ...
    

  5. Tested and worked fine!