Repositories access control with apache mod dav svn and mod perl » History » Version 13
Thomas Pihl, 2009-08-03 21:03
1 | 7 | Nicolas Chuche | h1. Repositories access control with apache mod dav svn and mod perl |
---|---|---|---|
2 | 1 | Nicolas Chuche | |
3 | 2 | Nicolas Chuche | {{>TOC}} |
4 | |||
5 | 4 | Jean-Philippe Lang | h2. Overview |
6 | 1 | Nicolas Chuche | |
7 | 3 | Jean-Philippe Lang | In this documentation, we will configure apache to delegate authentication to mod_perl. It's tested on apache2 with mysql and postgresql but should work with allmost every databases for which there is a perl DBD module. |
8 | 1 | Nicolas Chuche | |
9 | 3 | Jean-Philippe Lang | You need Redmine r860 or later. If your Redmine is older than r916, download "Redmine.pm":http://redmine.rubyforge.org/svn/trunk/extra/svn/Redmine.pm |
10 | 1 | Nicolas Chuche | |
11 | 4 | Jean-Philippe Lang | You need a working apache on your SVN server and you must install some modules at least mod_dav_svn, mod_perl2, DBI and DBD::mysql (or the DBD driver for you database as it should work on allmost all databases). |
12 | 1 | Nicolas Chuche | |
13 | 11 | Shaun Mangelsdorf | If the repositories are not created automatically by reposman.rb, it is important that the repository name is the same as the project identifier in Redmine, otherwise Redmine.pm will fail to authenticate users. |
14 | |||
15 | 1 | Nicolas Chuche | On Debian/ubuntu you must do : |
16 | |||
17 | 5 | Thomas Lecavelier | aptitude install libapache2-svn libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl libdigest-sha1-perl |
18 | 1 | Nicolas Chuche | |
19 | 4 | Jean-Philippe Lang | h2. Enabling apache modules |
20 | 1 | Nicolas Chuche | |
21 | On debian/ubuntu : |
||
22 | |||
23 | <pre> |
||
24 | a2enmod dav |
||
25 | a2enmod dav_svn |
||
26 | a2enmod perl |
||
27 | </pre> |
||
28 | |||
29 | 8 | Nicolas Chuche | h2. Apache configuration for subversion repositories and redmine 0.7.X and before |
30 | 1 | Nicolas Chuche | |
31 | 4 | Jean-Philippe Lang | You need to copy "Redmine.pm" on your SVN server and add something like that to your apache configuration (for example in @/etc/APACHE_DIR/conf.d/@) |
32 | 1 | Nicolas Chuche | |
33 | You must change the Redmine.pm path and database informations to fit your needs. |
||
34 | |||
35 | <pre> |
||
36 | PerlRequire /usr/local/apache/Redmine.pm |
||
37 | <Location /svn> |
||
38 | DAV svn |
||
39 | SVNParentPath "/var/svn" |
||
40 | |||
41 | AuthType Basic |
||
42 | AuthName redmine |
||
43 | Require valid-user |
||
44 | |||
45 | PerlAccessHandler Apache::Authn::Redmine::access_handler |
||
46 | PerlAuthenHandler Apache::Authn::Redmine::authen_handler |
||
47 | |||
48 | ## for mysql |
||
49 | PerlSetVar dsn DBI:mysql:database=databasename;host=my.db.server |
||
50 | ## for postgres |
||
51 | # PerlSetVar dsn DBI:Pg:dbname=databasename;host=my.db.server |
||
52 | |||
53 | PerlSetVar db_user redmine |
||
54 | PerlSetVar db_pass password |
||
55 | </Location> |
||
56 | |||
57 | 4 | Jean-Philippe Lang | # a private location in read only mode to allow Redmine browsing |
58 | <Location /svn-private> |
||
59 | DAV svn |
||
60 | SVNParentPath "/var/svn" |
||
61 | Order deny,allow |
||
62 | Deny from all |
||
63 | # only allow reading orders |
||
64 | <Limit GET PROPFIND OPTIONS REPORT> |
||
65 | Allow from redmine.server.ip |
||
66 | </Limit> |
||
67 | </Location> |
||
68 | 1 | Nicolas Chuche | </pre> |
69 | |||
70 | 3 | Jean-Philippe Lang | It will add add two Location directives, one @/svn@ with authentication and access control against the Redmine database for users and one @/svn-private@ in read-only with IP limitation for Redmine browsing. |
71 | 1 | Nicolas Chuche | |
72 | 3 | Jean-Philippe Lang | And that's done. You can try to browse some public repository with: |
73 | 1 | Nicolas Chuche | <pre> |
74 | svn ls http://my.svn.server/svn/myproject |
||
75 | </pre> |
||
76 | |||
77 | If you try to browse some non public repository, it will ask you a password. |
||
78 | 8 | Nicolas Chuche | |
79 | h2. Apache configuration for subversion repositories and redmine after 0.7.X |
||
80 | |||
81 | There's some difference in Redmine.pm so configuration is different. Everything else in the previous part works. |
||
82 | |||
83 | 9 | Nicolas Chuche | You first need to copy or link Redmine.pm to /usr/lib/perl5/Apache/Redmine.pm, then you add this configuration to apache : |
84 | 8 | Nicolas Chuche | <pre> |
85 | 9 | Nicolas Chuche | PerlLoadModule Apache::Redmine |
86 | 8 | Nicolas Chuche | <Location /svn> |
87 | DAV svn |
||
88 | SVNParentPath "/var/svn" |
||
89 | |||
90 | AuthType Basic |
||
91 | AuthName redmine |
||
92 | Require valid-user |
||
93 | |||
94 | PerlAccessHandler Apache::Authn::Redmine::access_handler |
||
95 | PerlAuthenHandler Apache::Authn::Redmine::authen_handler |
||
96 | |||
97 | ## for mysql |
||
98 | RedmineDSN "DBI:mysql:database=databasename;host=my.db.server" |
||
99 | ## for postgres |
||
100 | # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server" |
||
101 | |||
102 | RedmineDbUser "redmine" |
||
103 | RedmineDbPass "password" |
||
104 | </Location> |
||
105 | </pre> |
||
106 | |||
107 | 12 | Todd Nine | If you want to connect your LDAP authentication to Apache, you can install the Authen::Simple::LDAP perl module. I found that connecting to my LDAP server to authenticate with every request can be quite slow. I added the following to my configuration and had a significant performance increase. |
108 | |||
109 | <pre> |
||
110 | PerlLoadModule Apache::Redmine |
||
111 | <Location /svn> |
||
112 | DAV svn |
||
113 | SVNParentPath "/var/svn" |
||
114 | |||
115 | AuthType Basic |
||
116 | AuthName redmine |
||
117 | Require valid-user |
||
118 | |||
119 | PerlAccessHandler Apache::Authn::Redmine::access_handler |
||
120 | PerlAuthenHandler Apache::Authn::Redmine::authen_handler |
||
121 | |||
122 | ## for mysql |
||
123 | RedmineDSN "DBI:mysql:database=databasename;host=my.db.server" |
||
124 | ## for postgres |
||
125 | # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server" |
||
126 | |||
127 | RedmineDbUser "redmine" |
||
128 | RedmineDbPass "password" |
||
129 | #Cache the last 50 auth entries |
||
130 | RedmineCacheCredsMax 50 |
||
131 | </Location> |
||
132 | </pre> |
||
133 | |||
134 | |||
135 | 8 | Nicolas Chuche | h2. Apache configuration for after redmine 0.7.X and git access |
136 | |||
137 | 10 | Nicolas Chuche | Now that reposman.rb can create git repositories, you can use Redmine.pm to access them the same way than subversion. You first need to copy or link Redmine.pm to /usr/lib/perl5/Apache/Redmine.pm, then you add this configuration to apache : |
138 | 8 | Nicolas Chuche | |
139 | <pre> |
||
140 | Alias /git /var/git |
||
141 | |||
142 | 9 | Nicolas Chuche | PerlLoadModule Apache::Redmine |
143 | 8 | Nicolas Chuche | <Location /git> |
144 | DAV on |
||
145 | |||
146 | AuthType Basic |
||
147 | Require valid-user |
||
148 | AuthName "Git" |
||
149 | |||
150 | PerlAccessHandler Apache::Authn::Redmine::access_handler |
||
151 | PerlAuthenHandler Apache::Authn::Redmine::authen_handler |
||
152 | |||
153 | RedmineDSN "DBI:mysql:database=redmine;host=localhost" |
||
154 | RedmineDbUser "redmine" |
||
155 | RedmineDbPass "password" |
||
156 | </Location> |
||
157 | |||
158 | Alias /git-private /var/git |
||
159 | |||
160 | <Location /git-private> |
||
161 | Order deny,allow |
||
162 | Deny from all |
||
163 | <Limit GET PROPFIND OPTIONS REPORT> |
||
164 | Options Indexes FollowSymLinks MultiViews |
||
165 | Allow from 127.0.0.1 |
||
166 | </Limit> |
||
167 | </Location> |
||
168 | </pre> |
||
169 | |||
170 | To verify that you can access repository through Redmine.pm, you can use curl : |
||
171 | <pre> |
||
172 | % curl --netrc --location http://localhost/git/ecookbook/HEAD |
||
173 | ref: refs/heads/master |
||
174 | </pre> |
||
175 | 13 | Thomas Pihl | |
176 | h2. Gotchas |
||
177 | |||
178 | If you run this in Phusion Passenger, make sure you don't turn PassengerHighPerformance on. If you do, the rewrites to catch subversion dav will be bypassed with some interesting dump in the log as a result. |
||
179 | Example: |
||
180 | > ActionController::RoutingError (No route matches "/svn/rm-code" with {:method=>:get}): |
||
181 | (if your repo are named rm-code) |