[viewvc-users] Authz not restricting access as I expect

I'd appreciate some pointers to help me figure out why authz isn't
working as I expect it to (or why my expecations are wrong).

The symptom is that I can view parts of my repository in viewvc that I
think I've configured so that I shouldn't be able to, even though I'm
seeing "Access denied" messages in my Apache error log.

Configuration:

Viewvc 1.1.3

part of viewvc.conf:

[general]
svn_roots = svn: /var/lib/svn
[authz-svnauthz]
authzfile = /var/lib/svn/conf/authz

The only uncommented lines in /var/lib/svn/conf/authz are:

[/]
* =

In Apache 2.2.14, I have basic auth set up, and I authenticate as
[email protected].  Upper right corner of viewvc page says "Logged in
as: [email protected]".

part of httpd.conf:

<Location />
Order Deny,Allow                                                                
Allow from all                                                                  
Satisfy All                                                                     
AuthType basic           
# rest of details of auth set up omitted, hopefully not relevant
# as viewvc shows me logged in okay
</Location>
<Location /svn>                                                                 
DAV svn                                                                         
SVNPath /var/lib/svn                                                            
AuthzSVNAccessFile /var/lib/svn/conf/authz                                      
</Location>                                                                     
ScriptAlias /viewvc/ /home/poirier/viewvc/bin/cgi/viewvc.cgi/                   

I don't expect to have access to anything, but I seem able to browse at
will through the entire repository.  This despite Apache error log
messages like this:

[Wed Jan 06 08:27:17 2010] [error] [client 10.0.0.1] Access denied: '[email protected]' GET svn:/, referer: https://poirier.example.com:6666/viewvc/svn/foo/
/var/lib/python-support/python2.6/svn/fs.py:27: DeprecationWarning: The popen2 module is deprecated.  Use the subprocess module.
  import sys as _sys, os as _os, popen2 as _popen2, tempfile as  _tempfile

(I assume the 2nd message is harmless for now, but include it just in
case...)

I've tried reloading pages in Firefox, and restarting Apache.

Thanks for any pointers to help me track this down.

Dan

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2435166

To unsubscribe from this discussion, e-mail: [[email protected]].