0

I share subversion repositories using mod_dav_svn and Kerberos authentication mod_authz_kerb. All of this worked and recently it stopped. It authenticates the user for top level folder of the URL but not for any subfolders.

Here are the errors on the client side:

$ svn list https://myserver/svn/test
projectA/
projectB/
projectC/
projectD/

$ svn list https://myserver/svn/test/projectC
svn: E120190: Unable to connect to a repository at URL 'https://myserver/svn/test/projectC'
svn: E120190: Error running context: An error occurred during authentication

After running the first command the server outputs that it has authenticated the user verifying KDC:

[auth_kerb:debug] [pid 10694] src/mod_auth_kerb.c(1093): [client :57101] kerb_authenticate_user_krb5pwd ret=0 user=user@DOMAIN.CA authtype=Basic
[authz_svn:info] [pid 10694] [client :57101] Access granted: 'user@DOMAIN.CA' OPTIONS (null)

When running the second command on the server I just get:

[authz_svn:debug] [pid 10577] mod_authz_svn.c(449): [client :57072] Path to authz file is /opt/svn/generic_acl.conf
[authz_core:debug] [pid 10577] mod_authz_core.c(802): [client :57072] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)
[authz_core:debug] [pid 10577] mod_authz_core.c(802): [client :57072]   AH01626:   authorization result of <RequireAny>: denied (no authenticated user yet)

For the second command I don't get a prompt for the password and auth_kerb involved in any way.

The apache configuration for this is inside /etc/apache2/conf-enabled/subversion.conf:

<Location /svn/test>
    Dav svn
    SVNPath /srv/svn/test

    SVNListParentPath On
    SVNAutoVersioning On

    AuthName "DOMAIN.CA"
    AuthType Kerberos
    KrbMethodNegotiate On
    KrbMethodK5Passwd On
    KrbAuthoritative On
    KrbVerifyKDC On
    KrbAuthRealms DOMAIN.CA
    Krb5KeyTab /etc/krb5.keytab
    KrbServiceName HTTP

    AuthzSVNAccessFile /opt/svn/generic_acl.conf

    Require valid-user
</Location>

I have re-configured the directive to use Basic/htpasswd authentication and LDAP against the same Active Directory as configured for Kerberos. Those two alternative configurations seem work. It just seems like something is broken with recent apache/kerberos module.

Any suggestions would be greatly appreciated.

I'm using Ubuntu 14.04.3, apache 2.4.7-1ubuntu4.5, libapache2-mod-auth-kerb 5.4-2.1

1

Do you by chance have shibboleth on that server. Shibboleth seems to break basic auth in that valid-user doesn't work. Try

ShibCompatValidUser On in apache conf.

http://trwa.ca/2014/10/shibboleth-2-5-apache-2-4-and-breaking-apache-basic-auth/

For me, SVNParentPath seems to not work. If I use SVNPath it works as expected (but then I have to configure an entry in the apache conf for every repo)

And I too think something is broken. I upgraded to ubuntu 14.04 a few months ago but only started using the repo's again now.

|improve this answer|||||
  • add solution from link and give link . if information is more on link then add important part and add link for more info. it is not good practice to give answer with link only. – pl_rock Sep 19 '15 at 2:49
  • I don't have ShibCompatValidUser in apache.conf or anywhere in apache configuration (grep -R ShibCompatValidUser *) folder. But thank you for your answer. – Budric Sep 21 '15 at 14:51
0

For me downgrading to the previous version works:

aptitude install libapache2-mod-svn=1.8.8-1ubuntu3 libapache2-mod-svn=1.8.8-1ubuntu3 libsvn1=1.8.8-1ubuntu3 subversion=1.8.8-1ubuntu3

and put them on hold (at least until fix will be released):

aptitude hold libapache2-mod-svn libapache2-mod-svn libsvn1 subversion
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.