RE: [viewvc-users] Can ViewVC be configured for LDAP and multiple repositories?

Thanks.  I've made changes to the <Location> block for ViewVC like I had made for the svn block - that is to say I added the same commands which were required in the svn section for getting LDAP authentication to work - and it does not work.  If I change it to use a simple configuration - like out of the box - and an access file located on the file system then I can get viewVC to work however I cannot lock it down to specific folks using specific repositories.

I'll be doing more testing over the next few days....

Regards,
     Joseph


-----Original Message-----
From: C. Michael Pilato [mailto:[email protected]]
Sent: Monday, August 03, 2009 11:22 AM
To: Nassani, Joseph - ES/EW
Cc: [email protected]
Subject: Re: [viewvc-users] Can ViewVC be configured for LDAP and multiple repositories?

Nassani, Joseph - ES/EW wrote:
> I’m attempting to configure viewvc on my server which is hosting 3
> repositories whose authentication is controlled via LDAP (Microsoft
> Active Directory).  I’d like viewvc to understand LDAP authentication
> and to understand that I have 3 separate repositories which have
> different security requirements – folks from one should not be able to
> read the data from another.
>
> Can this be done?  If so any assistance would be very much appreciated.

ViewVC 1.1.0+ will accept from Apache whatever username Apache provides it,
and can be configured to use that username to test for path-based
authorization privileges against the likes of a Subversion authorization file.

So, if you aren't yet running ViewVC 1.1.0 or better, then, "No."

Assuming we're past that, though, you should be able to tell Apache that all
ViewVC access must pass through your LDAP authn mechanism easily enough.  By
this, I mean "as easily as you'd tell Apache to require LDAP authn for any
other thing on your system".  I don't have personal experience in this type
of configuration, but I suspect we're talking about a <Location> block for
your ViewVC URIs and a bunch of LDAP-related Apache directives inside there.

As long as Apache then communicates to ViewVC the LDAP-authenticated name of
the user via the standard way of doing so for CGI-based applications, and as
long as you are using a ViewVC authz plugin that cares about usernames (such
as the svnauthz one), ViewVC should be able to use that username in its
authorization checks.

--
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand


This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender.
Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2382729

To unsubscribe from this discussion, e-mail: [[email protected]].