Re: [viewvc-users] Authz not restricting access as I expect

Dan Poirier wrote:
> I'd appreciate some pointers to help me figure out why authz isn't
> working as I expect it to (or why my expecations are wrong).
> 
> The symptom is that I can view parts of my repository in viewvc that I
> think I've configured so that I shouldn't be able to, even though I'm
> seeing "Access denied" messages in my Apache error log.
> 
> Configuration:
> 
> Viewvc 1.1.3
> 
> part of viewvc.conf:
> 
> [general]
> svn_roots = svn: /var/lib/svn
> [authz-svnauthz]
> authzfile = /var/lib/svn/conf/authz

This looks good.

> The only uncommented lines in /var/lib/svn/conf/authz are:
> 
> [/]
> * =

Okay.  No access to anyone.  Check.


> In Apache 2.2.14, I have basic auth set up, and I authenticate as
> [email protected].  Upper right corner of viewvc page says "Logged in
> as: [email protected]".
> 
> part of httpd.conf:
> 
> <Location />
> Order Deny,Allow                                                                
> Allow from all                                                                  
> Satisfy All                                                                     
> AuthType basic           
> # rest of details of auth set up omitted, hopefully not relevant
> # as viewvc shows me logged in okay
> </Location>

Okay.  Authentication required at the root of the server.

> <Location /svn>                                                                 
> DAV svn                                                                         
> SVNPath /var/lib/svn                                                            
> AuthzSVNAccessFile /var/lib/svn/conf/authz                                      
> </Location>

And here we expose your Subversion repository through Subversion's
mod_dav_svn itself at the URL "/svn'.

> ScriptAlias /viewvc/ /home/poirier/viewvc/bin/cgi/viewvc.cgi/                   

...And now we expose your Subversion repository through ViewVC at the URL
"/viewvc/svn" ("/viewvc" from the Alias + "/svn" via the ViewVC
configuration above).

Now, a common problem that I've seen is having slashes that don't gel in
these ScriptAlias commands.  Sometimes this can result in ViewVC showing the
root listing okay, but then when you actually click a root's name, you get
tossed over to some non-ViewVC URL.  Can you confirm that when you think
you're viewing your repository's top-level directory in ViewVC, you're
looking at a URL that looks something like:  "http://.../viewvc/svn" ?

If not, consider dropping the trailing slash from your ScriptAlias parameters:

   ScriptAlias /viewvc /home/poirier/viewvc/bin/cgi/viewvc.cgi


-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2435583

To unsubscribe from this discussion, e-mail: [[email protected]].

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAktGO4oACgkQokEGqRcG/W42pwCeMA4ib/PbaTgYqkcyczx3Sepz
Uy8AnjmheEg/ekuX82zmMX+fa0Nskaop
=2l2U
-----END PGP SIGNATURE-----