Re: [viewvc-users] acl repositories for proper authorization

"C. Michael Pilato" <[email protected]> Thu, 01 May 2014 15:02:21 -0400
Newsgroups gmane.comp.version-control.cvs.viewcvs.user
Organization CollabNet, Inc.
Message-ID <[email protected]> 
On 05/01/2014 11:20 AM, Clay Jordan wrote:
> ViewVC users,
> 
> I’m currently investigating viewvc for use within my company for use
> with svn. We currently have thousands of repositories, and each has an
> acl file for authorization.
> 
> During testing, we’ve found that we can list the repos under svn_repos,
> and for each one, add in lines for authentication.. which is going to
> add about 6000+ lines to our conf file per server. We also notice we can
> specify the root_parent to get to our repos, but haven’t found a way to
> authorize per repo using this method. Has anyone done this?
> 
> I notice in the ViewVC FAQ;
> 
> “Does ViewVC support path-based authorization, such as Subversion's
> authz-file mechanism?
> 
> Yes, ViewVC 1.1.0 introduced this feature, and did so in a way that
> allows folks with Python programming skills to (relatively) easily drop
> in their own custom path-based authorization implementation modules.”
> 
> Since my Python programming skills are (relatively) lacking, I thought
> I’d see what others have done in this situation.

Clay,

The feature you need (and which ViewVC currently lacks) is support for
relative authz-file specification.  Subversion supports this itself as
of version 1.7 (via the AuthzSVNReposRelativeAccessFile) directive.
Very handy if you have all your repositories under just a few
SvnParentPaths and you can establish a convention for the location of
your access files (REPOSPATH/conf/access, e.g.).

I've considered trying to add this feature in the past, but always ran
into roadblocks.  For whatever reason (National Day of Prayer here in
the U.S.?), though, a few minutes ago I was inspired to try a new
approach that seems at first blush to work.  I've attached a patch in
hopes that you are interested and able to give it a shot.

ViewVC is pretty mature as software goes, so I don't invest terribly
many cycles on it these days.  But I think this feature is one that
would benefit many folks, so if you are able to test it out on your
gajillion repositories (I know, small request right?) and let me know
how it goes, that'd be tremendously helpful and I could hopefully roll
the feature into the next ViewVC 1.1.x release.

-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Enterprise Cloud Development

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=3077376

To unsubscribe from this discussion, e-mail: [[email protected]].
viewvc.relauthzfile.patch (text/x-patch, 4.3 KB) 
Add support for root-relative authz file configurations.

           * * * * * * * * * * * * * * * * * * * * * *
           *                                         *
           *   THIS CHANGE IS ONLY LIGHTLY TESTED!   *
           *                                         *
           * * * * * * * * * * * * * * * * * * * * * *


* conf/viewvc.conf.dist
  (root_relative_authzfile): New configuration option.  Mutually
    exclusive with 'authfile' option.

* lib/vcauth/svnauthz/__init__.py
  (__init__): Handle new 'root_relative_authzfile' and
    'root_lookup_func' parameters.
  (_get_authz_file): New helper function.
  (_get_paths_for_root): Use _get_authz_file() now.

* lib/viewvc.py
  (setup_authorizer): Add root lookup callback function, and pass it
    via params to the authorizer.
--This line, and those below, will be ignored--

Index: conf/viewvc.conf.dist
===================================================================
--- conf/viewvc.conf.dist	(revision 2931)
+++ conf/viewvc.conf.dist	(working copy)
@@ -1165,6 +1165,14 @@
 ##
 #authzfile =
 
+## root_relative_authzfile: Specifies the location of the
+## authorization rules file using an path relative to the repository.
+##
+## Example:
+## root_relative_authzfile = conf/access
+##
+#root_relative_authzfile = 
+
 ## force_username_case: Like the AuthzForceUsernameCase httpd.conf
 ## directive, set this to "upper" or "lower" to force the normalization
 ## to upper- or lower-case, respectively, of incoming usernames prior
Index: lib/vcauth/svnauthz/__init__.py
===================================================================
--- lib/vcauth/svnauthz/__init__.py	(revision 2931)
+++ lib/vcauth/svnauthz/__init__.py	(working copy)
@@ -23,13 +23,25 @@
   def __init__(self, username, params={}):
     self.rootpaths = { }  # {root -> { paths -> access boolean for USERNAME }}
     
-    # Get the authz file location from a passed-in parameter.
+    # Get the authz file location from exactly one of our related
+    # passed-in parameters.
     self.authz_file = params.get('authzfile')
-    if not self.authz_file:
+    self.rel_authz_file = params.get('root_relative_authzfile')
+    if not (self.authz_file or self.rel_authz_file):
       raise debug.ViewVCException("No authzfile configured")
-    if not os.path.exists(self.authz_file):
-      raise debug.ViewVCException("Configured authzfile file not found")
+    if self.authz_file and self.rel_authz_file:
+      raise debug.ViewVCException("Multiple authzfile locations defined")
 
+    # See if this authz file path is relative to the repository.
+    self.root_lookup_func = params.get('root_lookup_func')
+    if self.rel_authz_file:
+      if not self.root_lookup_func:
+        raise debug.ViewVCException("Relative authzfile file requires root "
+                                    "lookup callback function (not supplied)")
+    else:
+      if not os.path.exists(self.authz_file):
+        raise debug.ViewVCException("Configured authzfile file not found")
+
     # See if the admin wants us to do case normalization of usernames.
     self.force_username_case = params.get('force_username_case')
     if self.force_username_case == "upper":
@@ -42,6 +54,12 @@
       raise debug.ViewVCException("Invalid value for force_username_case "
                                   "option")
 
+  def _get_authz_file(self, rootname):
+    if self.rel_authz_file:
+      return os.path.join(self.root_lookup_func(rootname), self.rel_authz_file)
+    else:
+      return self.authz_file
+    
   def _get_paths_for_root(self, rootname):
     if self.rootpaths.has_key(rootname):
       return self.rootpaths[rootname]
@@ -54,7 +72,7 @@
     cp = ConfigParser()
     cp.optionxform = lambda x: x
     try:
-      cp.read(self.authz_file)
+      cp.read(self._get_authz_file(rootname))
     except:
       raise debug.ViewVCException("Unable to parse configured authzfile file")
 
Index: lib/viewvc.py
===================================================================
--- lib/viewvc.py	(revision 2931)
+++ lib/viewvc.py	(working copy)
@@ -819,6 +819,12 @@
   if not authorizer:
     return None
 
+  # Add a rootname mapping callback function to the parameters.
+  def _root_lookup_func(cb_rootname):
+    type, path = locate_root(cfg, cb_rootname)
+    return path
+  params['root_lookup_func'] = _root_lookup_func
+  
   # First, try to load a module with the configured name.
   import imp
   fp = None