Path authentication issues ( svnserve.exe )

[Eric Lee-5]

Hi,

 

I have been working with the path authentication a few hours by following the manual.

But it seems that it does't a first match as the manual wrote.

 

The user jane still be able to commit to the repository when working with groups.

However, when there are users only. It is fine.

 

quote from manual

 

Groups can be granted access control just like users. Distinguish them with an “at” (@) prefix:

[calc:/projects/calc]
@calc-developers = rw

[paint:/projects/paint]
jane = r
@paint-developers = rw

Another important fact is that the first matching rule is the one which gets applied to a user. In the prior example, even though Jane
is a member of the paint-developers group (which has read/write access), the jane = r rule will be discovered and
matched before the group rule, thus denying Jane write access.

 

Thanks,
--

[Vadym Chepkov]

If you show your whole authz file, maybe we can see what is wrong

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415428

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].

[Vadym Chepkov]

And one more thing.

Is path based authentication even enabled in svnserve.conf ?

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415429

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].

[Eric Lee-5]

On Sun, Nov 8, 2009 at 12:27 AM, Vadym Chepkov <chepkov@...> wrote:

And one more thing.

Is path based authentication even enabled in svnserve.conf

Yes, it is enabled with this line [authz-db = authz]

 

I test it exactly the same as the subversion manual's example.

so, when I use only two (or more) users without group(s).

That works perfectly.

 

 

Eric,

 

 

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415429

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].

--

[Vadym Chepkov]

Well,

Since you don't provide your config files, here are mine:

$ pwd
/home/vvc/testrepo/conf

$ cat passwd
[users]
vvc = vvcsecret
root = rootsecret

$ cat authz
[groups]
testgroup = root

[/]
vvc = r
@testgroup = rw

$ cat svnserve.conf
[general]
anon-access = none
password-db = passwd
authz-db = authz
realm = Test Repo

$ svn mkdir --username=vvc svn://localhost/home/vvc/testrepo/dir1 -m "dir1"
svn: Authorization failed

$ svn mkdir --username=root svn://localhost/home/vvc/testrepo/dir1 -m "dir1"

Committed revision 1.

All works as expected

Sincerely yours,
  Vadym Chepkov


--- On Sat, 11/7/09, Eric Lee <pgeric@...> wrote:

> From: Eric Lee <pgeric@...>
> Subject: Re: Path authentication issues ( svnserve.exe )
> To: "Vadym Chepkov" <chepkov@...>
> Cc: users@...
> Date: Saturday, November 7, 2009, 12:18 PM
>
>
>
> On Sun, Nov 8, 2009 at 12:27 AM,
> Vadym Chepkov <chepkov@...>
> wrote:
>
> And one more thing.
>
> Is path based authentication even enabled in svnserve.conf
>
>
>
>
> Yes, it is enabled with this line [authz-db =
> authz]
>  
> I test it exactly the same as the subversion
> manual's example.
> so, when I use only two (or more) users without
> group(s).
> That works perfectly.
>  
>  
> Eric,
>  
>  
> ------------------------------------------------------
> http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415429
>
>
>
>
>
> To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].
>
>
>
>
> --
>
>
>

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415445

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].

[Eric Lee-5]

On Sun, Nov 8, 2009 at 2:11 AM, Vadym Chepkov <chepkov@...> wrote:

Well,

Since you don't provide your config files, here are mine:

$ pwd
/home/vvc/testrepo/conf

$ cat passwd
[users]
vvc = vvcsecret
root = rootsecret

$ cat authz
[groups]
testgroup = root

[/]
vvc = r
@testgroup = rw

$ cat svnserve.conf
[general]
anon-access = none
password-db = passwd
authz-db = authz
realm = Test Repo

$ svn mkdir --username=vvc svn://localhost/home/vvc/testrepo/dir1 -m "dir1"
svn: Authorization failed

$ svn mkdir --username=root svn://localhost/home/vvc/testrepo/dir1 -m "dir1"

Committed revision 1.

All works as expected

Vadym

 

I'am appreciate your help !

 

I test it when I back home.

It looks like that I miss something with a few  settings.

 

 

Eric,

 

 

Sincerely yours,
 Vadym Chepkov


--- On Sat, 11/7/09, Eric Lee <pgeric@...> wrote:

> From: Eric Lee <pgeric@...>
> Subject: Re: Path authentication issues ( svnserve.exe )
> To: "Vadym Chepkov" <chepkov@...>
> Cc: users@...
> Date: Saturday, November 7, 2009, 12:18 PM

>
>
>
> On Sun, Nov 8, 2009 at 12:27 AM,
> Vadym Chepkov <chepkov@...>
> wrote:
>
> And one more thing.
>
> Is path based authentication even enabled in svnserve.conf
>
>
>
>
> Yes, it is enabled with this line [authz-db =
> authz]
>  
> I test it exactly the same as the subversion
> manual's example.
> so, when I use only two (or more) users without
> group(s).
> That works perfectly.
>  
>  
> Eric,
>  
>  
> ------------------------------------------------------
> http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415429
>
>
>
>
>
> To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].
>
>
>
>
> --
>
>
>

--
bLOG - sMALL-pOTATOS[dot]blogspot[dot[com
Site    - lightstudios[dot]co[dot]cc
Eric

[Eric Lee-5]

On Sun, Nov 8, 2009 at 1:20 PM, Eric Lee <pgeric@...> wrote:

On Sun, Nov 8, 2009 at 2:11 AM, Vadym Chepkov <chepkov@...> wrote:

Well,

Since you don't provide your config files, here are mine:

$ pwd
/home/vvc/testrepo/conf

$ cat passwd
[users]
vvc = vvcsecret
root = rootsecret

$ cat authz
[groups]
testgroup = root

 

 

OK, this is my before and current settings.

According to the manual. Rules are first-matching.

So the user should be blocked and can't be commited to the repository when the user was set to = r.

But it do as the result part showed.

 

Thanks,

 

[passwd]

blueray = svdgd4%#

[authz]

[groups]
paint-developers = blueray

 

[testextsvn:/branches/calc/bug-142]
blueray = r
@paint-developers = rw

 

[testextsvn:/]
* =

  [svnserve.conf]
  before
  anon-access = read

 

  after
  anon-access = none

  auth-access = write

 

  authz-db = authz

 

[result]

C:\wc\svnpathtest\branches\calc\bug-142>svn ci --username blueray -m "test"

Sending        bug-142\string.c
Transmitting file data .
Committed revision 23.

 

 

[/]
vvc = r
@testgroup = rw

$ cat svnserve.conf
[general]
anon-access = none
password-db = passwd
authz-db = authz
realm = Test Repo

$ svn mkdir --username=vvc svn://localhost/home/vvc/testrepo/dir1 -m "dir1"
svn: Authorization failed

$ svn mkdir --username=root svn://localhost/home/vvc/testrepo/dir1 -m "dir1"

Committed revision 1.

All works as expected

Vadym

 

I'am appreciate your help !

 

I test it when I back home.

It looks like that I miss something with a few  settings.

 

 

Eric,

 

 

Sincerely yours,
 Vadym Chepkov


--- On Sat, 11/7/09, Eric Lee <pgeric@...> wrote:

> From: Eric Lee <pgeric@...>
> Subject: Re: Path authentication issues ( svnserve.exe )
> To: "Vadym Chepkov" <chepkov@...>
> Cc: users@...
> Date: Saturday, November 7, 2009, 12:18 PM

>
>
>
> On Sun, Nov 8, 2009 at 12:27 AM,
> Vadym Chepkov <chepkov@...>
> wrote:
>
> And one more thing.
>
> Is path based authentication even enabled in svnserve.conf
>
>
>
>
> Yes, it is enabled with this line [authz-db =
> authz]
>  
> I test it exactly the same as the subversion
> manual's example.
> so, when I use only two (or more) users without
> group(s).
> That works perfectly.
>  
>  
> Eric,
>  
>  
> ------------------------------------------------------
> http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415429
>
>
>
>
>
> To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].
>
>
>
>
> --
>
>

[Vadym Chepkov]

I assume you start your svnserve with -r /path/to/repos
and /path/to/repos/testextsvn directory contains your repository?


--- On Sun, 11/8/09, Eric Lee <pgeric@...> wrote:

> OK, this is my before and current settings.
> According to the manual. Rules are
> first-matching.
> So the user should be blocked and can't be
> commited to the repository when the user was set to =
> r.
> But it do as the result part showed.
>  
> Thanks,
>  
> [passwd]
> blueray = svdgd4%#
>
> [authz]
> [groups]
> paint-developers = blueray
>  
> [testextsvn:/branches/calc/bug-142]
> blueray = r
> @paint-developers = rw
>  
> [testextsvn:/]
> * =
>
>   [svnserve.conf]
>   before
>   anon-access = read
>  
>   after
>   anon-access = none
>   auth-access = write
>  
>   authz-db = authz
>  
> [result]
> C:\wc\svnpathtest\branches\calc\bug-142>svn
> ci --username blueray -m "test"
> Sending        bug-142\string.c
> Transmitting file data .
> Committed revision 23.
>  

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415557

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].

[Eric Lee-5]

> I assume you start your svnserve with -r /path/to/repos
> and /path/to/repos/testextsvn directory contains your repository?

 

Yes, it is.

 

svnserve -d -r /path/to/svnroot -

 

C:\wc>svn ls svn://localhost/testextsvn
branches/
tags/
trunk/

 

 

Thanks,

 

 

On Sun, Nov 8, 2009 at 8:35 PM, Vadym Chepkov <chepkov@...> wrote:

I assume you start your svnserve with -r /path/to/repos
and /path/to/repos/testextsvn directory contains your repository?

--- On Sun, 11/8/09, Eric Lee <pgeric@...> wrote:

> OK, this is my before and current settings.
> According to the manual. Rules are
> first-matching.
> So the user should be blocked and can't be
> commited to the repository when the user was set to =
> r.
> But it do as the result part showed.
>  
> Thanks,
>  

> [passwd]
> blueray = svdgd4%#
>
> [authz]
> [groups]
> paint-developers = blueray
>  
> [testextsvn:/branches/calc/bug-142]
> blueray = r
> @paint-developers = rw

>  

> [testextsvn:/]
> * =
>
>   [svnserve.conf]
>   before
>   anon-access = read
>  
>   after
>   anon-access = none
>   auth-access = write
>  
>   authz-db = authz

>  
> [result]
> C:\wc\svnpathtest\branches\calc\bug-142>svn
> ci --username blueray -m "test"
> Sending        bug-142\string.c
> Transmitting file data .
> Committed revision 23.
>  

[Vadym Chepkov]

I concur to what you are seeing.
it seems if rw was granted in any way, it has precedence in recent versions of svnserve. I think you should file a bug report

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415588

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].

[Eric Lee-5]

On Mon, Nov 9, 2009 at 2:06 AM, Vadym Chepkov <chepkov@...> wrote:

I concur to what you are seeing.
it seems if rw was granted in any way, it has precedence in recent versions of svnserve. I think you should file a bug report

Vadym

 

Thanks

I will try to