svnserve with LDAP

Asked 2/12, 2008 at 5:40 Answered 10/5, 2011 at 5:55

I would like to know how to setup an SVN repository with LDAP authentication. I do not want to use Apache DAV though.

Hideaway answered 2/12, 2008 at 5:40 Comment(0)

There are two options:

Run svnserve as a server, and authenticate using SASL. Configure SASL to authenticate against LDAP.
Access the repository over ssh. Create ssh accounts for all users (perhaps automatically), and have these accounts authenticate against LDAP using PAM. Put all users into a single group, and make the repository files owned by that group.

Wartow answered 2/12, 2008 at 7:23 Comment(2)

Any clue on how to do option 1 on a Windows box? – Temporal 8/12, 2009 at 12:24

broken link "SASL to authenticate against LDAP" – Adermin 5/12, 2016 at 15:43

Since it took me some time to find the pieces to do this, I wanted to post how I did this on a RHEL5 server:

install CollabNet rpms (client, server, and extras).
run /opt/CollabNet_Subversion/bin/Configure-CollabNet-Subversion to configure without Apace and with svnserve.
modify your repo/conf/svnserve.conf file to have:
```
[sasl]
use-sasl=true
```

create /opt/CollabNet_Subversion/etc/saslauthd.conf file with these contents:

ldap_servers: ldaps://...
ldap_search_base: ...
ldap_bind_dn: ...
ldap_bind_pw: ...
ldap_auth_method: bind
ldap_timeout: 10

create /etc/opt/CollabNet_Subversion/sasl2/svn.conf file with these contents for use with MS AD LDAP:
```
pwcheck_method: saslauthd
auxprop_plugin: ldap
mech_list: PLAIN LOGIN
ldapdb_mech: PLAIN LOGIN
```
copy /etc/openldap/ldap.conf to /etc/opt/CollabNet_Subversion/conf/openldap and add TLS_REQCERT allow. This is required for our self-signed LDAP server
run collabnet saslauthd
- mkdir -p /var/state/saslauthd
- edit /etc/init.d/collabnet_subversion to include /opt/CollabNet_Subversion/sbin/saslauthd -a ldap towards end of start() function
- stop/start /etc/init.d/collabnet_subverison

note: you can use /opt/CollabNet_Subversion/sbin/testsaslauthd -u <userid> -p <password> to test sasl connection to ldap

A bit involved, but for me, it allows our clients to connect to svn:// using their ldap passwords.

Saxe answered 5/5, 2011 at 14:17 Comment(0)

You could use scm-manager which has an ldap plugin.

Precision answered 10/5, 2011 at 5:55 Comment(0)