Re: Re: [viewvc-users] viewvc, and using svn+ssh

------=_Part_13803_1259060787.1449777272636
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Thu, Dec 10, 2015 at 1:25 PM, Dave Uebele <[email protected]> wrote:

> Ideally I would like viewvc to authenticate user/password obtained from
> our LDAP authority at the https level.
> That would allow anyone with a valid user account in ldap to get that far=
.
>
> Next, have viewvc parse, or follow the svnserve access rules. I assume
> that would be creating the right configuration steps inside
> /etc/viewvc/viewvc.conf.
> A user password may be perfectly valid, and yet they would be completely
> blocked if they did not meet the svnserve group rules sets in authz-db
> defined file.


So, in case you don't already know, ViewVC doesn't do anything
authentication-wise.  Rather, Apache handles the authentication phase.
ViewVC simply gets the username of the active user handed to it by Apache
(via the CGI environment, or more directly in the mod_wsgi/mod_python
deployment scenarios).  You'll want to configure Apache to authenticate
your ViewVC users, and generally do so by using the same sorts of
directives you would have used in your Subversion <Location> inside your
ViewVC <Location> instead.  I suspect that you could literally just copy
and paste your existing LDAP Subversion configuration into your ViewVC
configuration area.  For example:

<Location "/viewvc">
    AuthType Basic
    AuthName "LDAP Credentials"
    AuthBasicProvider ldap
    AuthLDAPURL *=E2=80=9C[LDAP-URL]*"
    AuthLDAPBindDN "*[BIND-DN]*"
    AuthLDAPBindPassword *[BIND-PASSWORD]*
    ...
</Location>

Authorization (path-based access control), on the other hand, falls to
ViewVC.  In viewvc.conf, you'll need to set the 'authorizer' configuration
option to "svnauthz", and then configure the location of your Subversion
authz file in the "[authz-svnauthz]" section of viewvc.conf.

-- Mike

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=3D4255&dsMessageId=3D3=
150442

To unsubscribe from this discussion, e-mail: [[email protected]=
is.org].
------=_Part_13803_1259060787.1449777272636
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On T=
hu, Dec 10, 2015 at 1:25 PM, Dave Uebele <span dir=3D"ltr">&lt;<a href=3D"m=
ailto:[email protected]" target=3D"_blank">[email protected]</a>&gt;</span>=
 wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.=
8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-st=
yle:solid;padding-left:1ex">Ideally I would like viewvc to authenticate use=
r/password obtained from our LDAP authority at the https level.<br>
That would allow anyone with a valid user account in ldap to get that far.<=
br>
<br>
Next, have viewvc parse, or follow the svnserve access rules. I assume that=
 would be creating the right configuration steps inside /etc/viewvc/viewvc.=
conf.<br>
A user password may be perfectly valid, and yet they would be completely bl=
ocked if they did not meet the svnserve group rules sets in authz-db define=
d file.</blockquote><div><br></div><div>So, in case you don&#39;t already k=
now, ViewVC doesn&#39;t do anything authentication-wise.=C2=A0 Rather, Apac=
he handles the authentication phase.=C2=A0 ViewVC simply gets the username =
of the active user handed to it by Apache (via the CGI environment, or more=
 directly in the mod_wsgi/mod_python deployment scenarios).=C2=A0 You&#39;l=
l want to configure Apache to authenticate your ViewVC users, and generally=
 do so by using the same sorts of directives you would have used in your Su=
bversion &lt;Location&gt; inside your ViewVC &lt;Location&gt; instead.=C2=
=A0 I suspect that you could literally just copy and paste your existing LD=
AP Subversion configuration into your ViewVC configuration area.=C2=A0 For =
example:</div><div><br></div><div><div>&lt;Location &quot;/viewvc&quot;&gt;=
</div><div>=C2=A0 =C2=A0 AuthType Basic</div><div>=C2=A0 =C2=A0 AuthName &q=
uot;LDAP Credentials&quot;</div><div>=C2=A0 =C2=A0 AuthBasicProvider ldap</=
div><div>=C2=A0 =C2=A0 AuthLDAPURL=C2=A0<i>=E2=80=9C[LDAP-URL]</i>&quot;<br=
></div><div>=C2=A0 =C2=A0 AuthLDAPBindDN &quot;<i>[BIND-DN]</i>&quot;</div>=
<div>=C2=A0 =C2=A0 AuthLDAPBindPassword <i>[BIND-PASSWORD]</i></div><div>=
=C2=A0 =C2=A0 ...<br></div><div>&lt;/Location&gt;</div></div><div><br></div=
><div>Authorization (path-based access control), on the other hand, falls t=
o ViewVC.=C2=A0 In viewvc.conf, you&#39;ll need to set the &#39;authorizer&=
#39; configuration option to &quot;svnauthz&quot;, and then configure the l=
ocation of your Subversion authz file in the &quot;[authz-svnauthz]&quot; s=
ection of viewvc.conf.</div><div><br></div><div>-- Mike</div></div></div></=
div>

------=_Part_13803_1259060787.1449777272636--