Project

General

Profile

Repositories access control with apache mod dav svn and mod perl » History » Version 29

Steven Lu, 2011-08-20 18:25

1 16 Jean-Philippe Lang
h1. Repositories access control with apache, mod_dav_svn and mod_perl
2 1 Nicolas Chuche
3 2 Nicolas Chuche
{{>TOC}}
4
5 4 Jean-Philippe Lang
h2. Overview
6 1 Nicolas Chuche
7 23 Eric Davis
In this documentation, we will configure apache to delegate authentication to mod_perl. It's tested on apache2 (@apache2-mpm-prefork@) with mysql and postgresql but should work with allmost every databases for which there is a perl DBD module.  Apache2 with the high speed thread model might not load Perl correctly (@apache2-mpm-worker@).
8 1 Nicolas Chuche
9
You need a working apache on your SVN server and you must install some modules at least mod_dav_svn, mod_perl2, DBI and DBD::mysql (or the DBD driver for you database as it should work on allmost all databases).
10 4 Jean-Philippe Lang
11 15 Jean-Philippe Lang
On Debian/ubuntu you can do :
12 11 Shaun Mangelsdorf
13 27 Bill Dieter
  sudo aptitude install libapache2-svn libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl libdigest-sha1-perl libauthen-simple-ldap-perl
14 1 Nicolas Chuche
15 27 Bill Dieter
If the repositories are not created automatically by reposman.rb, it is important that the repository name is the same as the project identifier in Redmine, otherwise Redmine.pm will fail to authenticate users.  For example, if the path to the repository is @/path/to/repository/foo-bar@, then the project Identifier on the Settings page must be @foo-bar@.
16 1 Nicolas Chuche
17
h2. Enabling apache modules
18
19
On debian/ubuntu :
20
21
<pre>
22 15 Jean-Philippe Lang
sudo a2enmod dav
23 21 Marko Roeder
sudo a2enmod dav_svn # if you want to use svn
24
sudo a2enmod dav_fs  # if you want to use git
25 15 Jean-Philippe Lang
sudo a2enmod perl
26 4 Jean-Philippe Lang
</pre>
27 1 Nicolas Chuche
28 15 Jean-Philippe Lang
h2. Apache configuration for Subversion repositories
29 1 Nicolas Chuche
30 15 Jean-Philippe Lang
You first need to copy or link @Redmine.pm@ to @/usr/lib/perl5/Apache/Redmine.pm@
31 29 Steven Lu
- Redmine.pm can be found in $REDMINE_DIR/extra/svn/Redmine.pm
32
- In the Debian install, it is found /usr/share/redmine/extra/svn/Redmine.pm
33 15 Jean-Philippe Lang
Then add the following Location directives to your apache configuration (for example in @/etc/APACHE_DIR/conf.d/@):
34 1 Nicolas Chuche
35 17 Joachim Fritschi
* the old how-to which suggested two separate locations for with @/svn@  and @/svn-private@ can be avoided
36
* with the @Satisfy any@ keyword from Apache you can define different authentication policies
37
* read access from the redmine-server or any validated user
38
* write access only validated users
39 15 Jean-Philippe Lang
40 17 Joachim Fritschi
41 15 Jean-Philippe Lang
<pre>
42 1 Nicolas Chuche
   # /svn location for users
43
   PerlLoadModule Apache::Redmine
44
   <Location /svn>
45
     DAV svn
46 19 Joachim Fritschi
     SVNParentPath "/var/svn"
47 17 Joachim Fritschi
     Order deny,allow
48
     Deny from all
49
     Satisfy any
50 1 Nicolas Chuche
51
     PerlAccessHandler Apache::Authn::Redmine::access_handler
52
     PerlAuthenHandler Apache::Authn::Redmine::authen_handler
53 17 Joachim Fritschi
     AuthType Basic
54 18 Joachim Fritschi
     AuthName "Redmine SVN Repository"
55 17 Joachim Fritschi
56
     #read-only access	
57
     <Limit GET PROPFIND OPTIONS REPORT>
58 19 Joachim Fritschi
        Require valid-user
59 17 Joachim Fritschi
        Allow from redmine.server.ip
60
        # Allow from another-ip
61
     	Satisfy any
62
     </Limit>
63
     # write access
64
     <LimitExcept GET PROPFIND OPTIONS REPORT>
65
   	Require valid-user
66
     </LimitExcept>
67
68
69 1 Nicolas Chuche
     ## for mysql
70
     RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
71 4 Jean-Philippe Lang
     ## for postgres
72 1 Nicolas Chuche
     # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
73 4 Jean-Philippe Lang
     ## for SQLite3
74 1 Nicolas Chuche
     # RedmineDSN "DBI:SQLite:dbname=database.db"
75
76
     RedmineDbUser "redmine"
77
     RedmineDbPass "password"
78
  </Location>
79
80
</pre>
81
82 17 Joachim Fritschi
h3. Testing the configuration:
83 1 Nicolas Chuche
84 17 Joachim Fritschi
After reloading apache conf, you can try to browse some repository with:
85
86 1 Nicolas Chuche
<pre>
87
svn ls http://my.svn.server/svn/myproject
88 4 Jean-Philippe Lang
</pre>
89 1 Nicolas Chuche
90 17 Joachim Fritschi
Any non-public repository should ask for a username and password.
91 4 Jean-Philippe Lang
92 17 Joachim Fritschi
To test the authentication that allows you redmine server to read all repositories:
93 1 Nicolas Chuche
94 17 Joachim Fritschi
Reading a private repository:
95 3 Jean-Philippe Lang
<pre>
96 17 Joachim Fritschi
svn ls http://my.svn.server/svn/myproject
97
</pre>
98
Try writing to the repository:
99
<pre>
100
svn mkdir http://my.svn.server/svn/myproject/testdir
101
</pre>
102
This should fail and ask for a password.
103
104
105
h3. optional LDAP Authentication
106
107
If you want to connect your LDAP authentication to Apache, you can install the Authen::Simple::LDAP perl module. I found that connecting to my LDAP server to authenticate with every request can be quite slow. I added the following to my configuration and had a significant performance increase. If you have configured an encrypted connection to the LDAP server you will need the IO::Socket::SSL module.
108
109 20 Stefan Stefansson
> *NOTE: the above wording is a little confusing. I attempt to clear up the issues I had with this in the following paragraph.*
110
> 
111
> First of all, make sure that you have the Net::LDAP module installed as well. I installed Authen::Simple::LDAP through CPAN and found that nothing worked. Eventually I figured out that this was because the Authen::Simple::LDAP did not require the Net::LDAP module as a dependency but it is needed for our purpose here. I did this on CentOS and it seems that the Net::LDAP module can be installed via yum (@yum install perl-LDAP@) but the Authen::Simple::LDAP had to be installed via CPAN since there's no RPM for it in the CentOS repositories.
112
> 
113 28 Rahul Panwar
114
To install the Authen::Simple::LDAP using CPAN use commands:
115
<pre>
116
cpan
117
cpan> install Authen::Simple::LDAP
118
</pre>
119
if the installation failed due to some dependencies, resolve the dependencies first.
120
121 20 Stefan Stefansson
> My second point is related to the below Apache config. The @PerlLoadModule Authen::Simple::LDAP@ is actually not required for having users authenticated via LDAP. It will happen automatically if both of the above modules are installed. So there really is no difference between the config snippet below and the one above except for the @RedmineCacheCredsMax 50@ line which is probably a good idea although it can result in users that have been deleted or removed in redmine still getting access to the repositories, at least for a little while.
122
123 17 Joachim Fritschi
<pre>
124 8 Nicolas Chuche
   PerlLoadModule Apache::Redmine
125 17 Joachim Fritschi
   PerlLoadModule  Authen::Simple::LDAP
126
   # PerlLoadModule  IO::Socket::SSL
127 12 Todd Nine
   <Location /svn>
128
     DAV svn
129
     SVNParentPath "/var/svn"
130
131
     AuthType Basic
132
     AuthName redmine
133
     Require valid-user
134
135
     PerlAccessHandler Apache::Authn::Redmine::access_handler
136
     PerlAuthenHandler Apache::Authn::Redmine::authen_handler
137
  
138
     ## for mysql
139
     RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
140
     ## for postgres
141
     # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
142
143
     RedmineDbUser "redmine"
144
     RedmineDbPass "password"
145
     #Cache the last 50 auth entries
146
     RedmineCacheCredsMax 50
147
  </Location>
148
</pre>
149 15 Jean-Philippe Lang
150 12 Todd Nine
151 15 Jean-Philippe Lang
h2. Apache configuration for Git repositories
152
153
Now that reposman.rb can create git repositories, you can use Redmine.pm to access them the same way than subversion. 
154 8 Nicolas Chuche
155
You first need to copy or link Redmine.pm to /usr/lib/perl5/Apache/Redmine.pm, then you add this configuration to apache : 
156
157
<pre>
158 9 Nicolas Chuche
Alias /git /var/git
159 8 Nicolas Chuche
160
PerlLoadModule Apache::Redmine
161
<Location /git>
162
  DAV on
163
164
  AuthType Basic
165
  Require valid-user
166
  AuthName "Git"
167
168
  PerlAccessHandler Apache::Authn::Redmine::access_handler
169
  PerlAuthenHandler Apache::Authn::Redmine::authen_handler
170
171
  RedmineDSN "DBI:mysql:database=redmine;host=localhost"
172
  RedmineDbUser "redmine"
173
  RedmineDbPass "password"
174
</Location>
175
176
Alias /git-private /var/git
177
178
<Location /git-private>
179
   Order deny,allow
180
   Deny from all
181
   <Limit GET PROPFIND OPTIONS REPORT>
182
      Options Indexes FollowSymLinks MultiViews
183
   Allow from 127.0.0.1
184
   </Limit>
185
</Location>
186
</pre>
187
188
To verify that you can access repository through Redmine.pm, you can use curl :
189
<pre>
190
% curl --netrc --location http://localhost/git/ecookbook/HEAD   
191 13 Thomas Pihl
ref: refs/heads/master
192
</pre>
193
194 22 Diego Oliveira
h2. Apache configuration for Mercurial repositories
195
196
Create a file caled "hgweb.config" in the same folder as "hgwebdir.cgi". This foder will be the root repository folder. Then edit the "hgweb.config" with something like this:
197
198
<pre>
199
[paths]
200
/=/path/to/root/repository/**
201
202
[web]
203
allow_push = *
204
allowbz2 = yes
205
allowgz = yes
206
allowzip = yes
207
208
</pre>
209
210
Follows the instructions to install Redmine.pm as described and configure your apache like this.
211
212
<pre>
213
    RewriteEngine on
214
    PerlLoadModule Apache2::Redmine
215
    PerlLoadModule Authen::Simple::LDAP
216
    ScriptAliasMatch ^/hg(.*)  /path/to/the/hgwebdir.cgi/$1
217
    <Location /hg>
218
        AuthType Basic
219
        AuthName "Mercurial"
220
        Require valid-user
221
222
        #Redmine auth
223
        PerlAccessHandler Apache::Authn::Redmine::access_handler
224
        PerlAuthenHandler Apache::Authn::Redmine::authen_handler
225
        RedmineDSN "DBI:mysql:database=redmine;host=localhost"
226
        RedmineDbUser "DB_USER"
227
        RedmineDbPass "DB_PASSWD"
228
    </Location>
229
</pre>
230
231
232 13 Thomas Pihl
h2. Gotchas
233
234
If you run this in Phusion Passenger, make sure you don't turn PassengerHighPerformance on. If you do, the rewrites to catch subversion dav will be bypassed with some interesting dump in the log as a result.
235
Example: 
236 1 Nicolas Chuche
> ActionController::RoutingError (No route matches "/svn/rm-code" with {:method=>:get}):
237
(if your repo are named rm-code)
238 27 Bill Dieter
239
When using @Authen::Simple::LDAP@ for authentication, it is not sufficient to have the Administrator role to access a repository.  The user must have a role with that specifically allows the user to browse, read, or write the repository.