Subversion (DAV/Apache) and password

lil_drummaboy · 07-15-2008, 02:24 PM

Hey Guys,

I have some repositories in Subversion I would like password protected on commit (which it does fine) but ALSO on checkout. So basically, you would need to be authenticated to access anything.

Previously we had the following setup, allowing checkouts, but asks for credentials on commits:

Code:

LoadModule dav_svn_module     modules/mod_dav_svn.so
LoadModule authz_svn_module   modules/mod_authz_svn.so

<Location /svn/>
   DAV svn

   SVNParentPath /home/svn
   #list all repos.
   SVNListParentPath on

   <LimitExcept GET PROPFIND OPTIONS REPORT>
      # Require SSL connection for password protection.
      #SSLRequireSSL

      AuthType Basic
      AuthName "xxx Inc. Repositories"
      AuthUserFile /home/svn/svn_auth
      Order deny,allow
      Require valid-user
   </LimitExcept>

</Location>

This is what I have currently, it asks for auth when you visit it in a web browser, but when you checkout from linux command line "svn co https://...." it DOES NOT ask for a password. So this seems to have only locked HTTP/Web access viewing of our repositories, but still allows the linux subversion command to checkout without password:

Code:

LoadModule dav_svn_module     modules/mod_dav_svn.so
LoadModule authz_svn_module   modules/mod_authz_svn.so

<Location /svn/>
   DAV svn

   SVNParentPath /home/svn
   #list all repos.
   SVNListParentPath on

   # Authentication for all commands:
   AuthType Basic
   AuthName "xxx Inc. Repositories"
   AuthUserFile /home/svn/svn_auth
   Order deny,allow
   Require valid-user

</Location>

Has anyone been able to fix this in the past? I actually did search google and didn't find quite what I was looking for.

Cheers/thanks!

lil_drummaboy · 07-23-2008, 01:29 PM

Does anyone know of a forum that would be more appropriate for this question, it seems like a really simple thing to do with SVN, just it still allows svn clients in and only asks for auth when you go to the SVN in a web browser.

kenoshi · 07-24-2008, 12:36 AM

This probably belong in the software forum.

Anyway, assuming you are using linux clients based on your post, did you try disabling the storing of auth-creds on your client systems?