Re: [viewvc-users] Questions concerning correctly configuring ViewVC to take advantage of the new "path-based authorization" feature...

Bensing, Matthew L (IS) wrote:
> Dear ViewVC team/developers,
>  
> We are currently running Subversion 1.4.2, Apache 2.2.3, CentOS 5.1,
> ViewVC 1.0.5, and Tortoise Subversion from our Window desktops. 
>  
> Our server is joined to our Windows Active Directory structure and
> uses Kerberos for the authentication of its users, which then in turn
> uses the svn-authz-access file for access control to the various
> repositories on the server.
>  
> Our goal is to *_limit_* read/(checkout) access from TortoiseSVN and
> viewable access from our internal intranet.
>  
> To that end, yesterday we down loaded the beta1 release of ViewVC to
> our development server, installed it, and linked it in properly so
> that we could regress if things did not work out as expected.
>  
> We changed our dav_svn.conf file, which is located in
> /etc/httpd/conf.d to what is attached in the email.  By making the
> changes at the bottom of the file from <LimitExcept> to <Limit> we
> were able to get TortoiseSVN to now prompt for a username/password
> combination when anyone tries to read/checkout a file.  If their
> permissions associated with their username is in the svn-authz-acces
> file, then they get to check it out.  If it is not, then they are
> denied access.
>  
> This was great and so far so good.
>  
> We then did some reading about the new repository viewing stuff and
> made the appropriate changes in the viewvc-1.1.0beta.conf file.  The
> changes we made to make this take effect were:
>  
> Changed authorizer = forbidden to authorizer = svnauthz.
>  
> Then we changed
>  
> authzfile =
>  
> to
>
> authzfile = /svn/svn-authz-access
>
> We then restarted the server and browsed to our repository and low and
> behold the repository that had the *=r commented out in the
> svn-authz-access file was no longer viewable.  Success we think.
>  
>  
> *_Our question is this_*: 
> Is our configuration now correctly configured or is there more to it? 
> Should a user who has privileges to checkout/commit to a
> "non-viewable" repository still  be able to view it by using a
> internet browser?  Also, can you provide or point us to documentation
> defining the 'methods' used for <Limit> and <LimitExcept>, since I
> have not had any success locating such definitions from Apache website.
>  
> Please advise us as to whether or not this is the expected results
> so that we can make a determination to go live with this or not. 
> Also, if currently you cannot view a repository via a web browser that
> you have privileges to then we would like to see that as a feature in
> the future as we would like to do this if at all possible.
>  
>
In terms of the ViewVC configuration, it's pretty much as simple as
you've described.  Sorry.  We could try to make it harder if you'd
like.  :-)

By switching from <LimitExcept> to <Limit>, I'm concerned that you might
have just traded "public read, private write" for "private read, public
write".  You probably don't want that.  Since you are using
AuthzSVNAccessFile, I should think you wouldn't need either Limit or
LimitExcept -- you basically want all accessors of the repository to
provide authentication credentials, right?  If so, lose the LimitExcept
tags (moving "Require valid-user" directly into the <Location> block).

-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2057504

To unsubscribe from this discussion, e-mail: [[email protected]].

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkn/CowACgkQokEGqRcG/W45RACfa1eLLW7CVdLCboM/clhm0E8L
V7MAnisXGLVNIvb5IqQZhk8a5cn6OiSR
=G4LB
-----END PGP SIGNATURE-----