I share subversion repositories using mod_dav_svn and Kerberos authentication mod_authz_kerb. All of this worked and recently it stopped. It authenticates the user for top level folder of the URL but not for any subfolders.
Here are the errors on the client side:
$ svn list https://myserver/svn/test projectA/ projectB/ projectC/ projectD/ $ svn list https://myserver/svn/test/projectC svn: E120190: Unable to connect to a repository at URL 'https://myserver/svn/test/projectC' svn: E120190: Error running context: An error occurred during authentication
After running the first command the server outputs that it has authenticated the user verifying KDC:
[auth_kerb:debug] [pid 10694] src/mod_auth_kerb.c(1093): [client :57101] kerb_authenticate_user_krb5pwd ret=0 user=user@DOMAIN.CA authtype=Basic [authz_svn:info] [pid 10694] [client :57101] Access granted: 'user@DOMAIN.CA' OPTIONS (null)
When running the second command on the server I just get:
[authz_svn:debug] [pid 10577] mod_authz_svn.c(449): [client :57072] Path to authz file is /opt/svn/generic_acl.conf [authz_core:debug] [pid 10577] mod_authz_core.c(802): [client :57072] AH01626: authorization result of Require valid-user : denied (no authenticated user yet) [authz_core:debug] [pid 10577] mod_authz_core.c(802): [client :57072] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
For the second command I don't get a prompt for the password and auth_kerb involved in any way.
The apache configuration for this is inside /etc/apache2/conf-enabled/subversion.conf:
<Location /svn/test> Dav svn SVNPath /srv/svn/test SVNListParentPath On SVNAutoVersioning On AuthName "DOMAIN.CA" AuthType Kerberos KrbMethodNegotiate On KrbMethodK5Passwd On KrbAuthoritative On KrbVerifyKDC On KrbAuthRealms DOMAIN.CA Krb5KeyTab /etc/krb5.keytab KrbServiceName HTTP AuthzSVNAccessFile /opt/svn/generic_acl.conf Require valid-user </Location>
I have re-configured the directive to use Basic/htpasswd authentication and LDAP against the same Active Directory as configured for Kerberos. Those two alternative configurations seem work. It just seems like something is broken with recent apache/kerberos module.
Any suggestions would be greatly appreciated.
I'm using Ubuntu 14.04.3, apache 2.4.7-1ubuntu4.5, libapache2-mod-auth-kerb 5.4-2.1