Repositories access control with apache mod dav svn and mod perl » History » Version 36

neil johnson, 2011-11-15 11:47

1 16 Jean-Philippe Lang
h1. Repositories access control with apache, mod_dav_svn and mod_perl
2 1 Nicolas Chuche
3 2 Nicolas Chuche
{{>TOC}}
4 2 Nicolas Chuche
5 4 Jean-Philippe Lang
h2. Overview
6 1 Nicolas Chuche
7 23 Eric Davis
In this documentation, we will configure apache to delegate authentication to mod_perl. It's tested on apache2 (@apache2-mpm-prefork@) with mysql and postgresql but should work with allmost every databases for which there is a perl DBD module.  Apache2 with the high speed thread model might not load Perl correctly (@apache2-mpm-worker@).
8 1 Nicolas Chuche
9 1 Nicolas Chuche
You need a working apache on your SVN server and you must install some modules at least mod_dav_svn, mod_perl2, DBI and DBD::mysql (or the DBD driver for you database as it should work on allmost all databases).
10 4 Jean-Philippe Lang
11 15 Jean-Philippe Lang
On Debian/ubuntu you can do :
12 11 Shaun Mangelsdorf
13 33 neil johnson
  sudo aptitude install libapache2-svn libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl libdigest-sha1-perl
14 1 Nicolas Chuche
15 33 neil johnson
If the repositories are not created automatically by reposman.rb, it is important that the repository name is the same as the project identifier in Redmine, otherwise Redmine.pm will fail to authenticate users.
16 1 Nicolas Chuche
17 1 Nicolas Chuche
h2. Enabling apache modules
18 1 Nicolas Chuche
19 1 Nicolas Chuche
On debian/ubuntu :
20 1 Nicolas Chuche
21 1 Nicolas Chuche
<pre>
22 15 Jean-Philippe Lang
sudo a2enmod dav
23 21 Marko Roeder
sudo a2enmod dav_svn # if you want to use svn
24 21 Marko Roeder
sudo a2enmod dav_fs  # if you want to use git
25 15 Jean-Philippe Lang
sudo a2enmod perl
26 4 Jean-Philippe Lang
</pre>
27 1 Nicolas Chuche
28 15 Jean-Philippe Lang
h2. Apache configuration for Subversion repositories
29 30 Steven Lu
30 31 Steven Lu
You first need to copy or link @Redmine.pm@ to @/usr/lib/perl5/Apache/Redmine.pm@
31 15 Jean-Philippe Lang
Then add the following Location directives to your apache configuration (for example in @/etc/APACHE_DIR/conf.d/@):
32 1 Nicolas Chuche
33 17 Joachim Fritschi
* the old how-to which suggested two separate locations for with @/svn@  and @/svn-private@ can be avoided
34 17 Joachim Fritschi
* with the @Satisfy any@ keyword from Apache you can define different authentication policies
35 17 Joachim Fritschi
* read access from the redmine-server or any validated user
36 17 Joachim Fritschi
* write access only validated users
37 15 Jean-Philippe Lang
38 17 Joachim Fritschi
39 15 Jean-Philippe Lang
<pre>
40 1 Nicolas Chuche
   # /svn location for users
41 1 Nicolas Chuche
   PerlLoadModule Apache::Redmine
42 1 Nicolas Chuche
   <Location /svn>
43 1 Nicolas Chuche
     DAV svn
44 19 Joachim Fritschi
     SVNParentPath "/var/svn"
45 17 Joachim Fritschi
     Order deny,allow
46 17 Joachim Fritschi
     Deny from all
47 17 Joachim Fritschi
     Satisfy any
48 1 Nicolas Chuche
49 1 Nicolas Chuche
     PerlAccessHandler Apache::Authn::Redmine::access_handler
50 1 Nicolas Chuche
     PerlAuthenHandler Apache::Authn::Redmine::authen_handler
51 17 Joachim Fritschi
     AuthType Basic
52 18 Joachim Fritschi
     AuthName "Redmine SVN Repository"
53 17 Joachim Fritschi
54 17 Joachim Fritschi
     #read-only access	
55 17 Joachim Fritschi
     <Limit GET PROPFIND OPTIONS REPORT>
56 19 Joachim Fritschi
        Require valid-user
57 17 Joachim Fritschi
        Allow from redmine.server.ip
58 17 Joachim Fritschi
        # Allow from another-ip
59 17 Joachim Fritschi
     	Satisfy any
60 17 Joachim Fritschi
     </Limit>
61 17 Joachim Fritschi
     # write access
62 17 Joachim Fritschi
     <LimitExcept GET PROPFIND OPTIONS REPORT>
63 17 Joachim Fritschi
   	Require valid-user
64 17 Joachim Fritschi
     </LimitExcept>
65 17 Joachim Fritschi
66 17 Joachim Fritschi
67 1 Nicolas Chuche
     ## for mysql
68 1 Nicolas Chuche
     RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
69 4 Jean-Philippe Lang
     ## for postgres
70 1 Nicolas Chuche
     # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
71 4 Jean-Philippe Lang
     ## for SQLite3
72 1 Nicolas Chuche
     # RedmineDSN "DBI:SQLite:dbname=database.db"
73 1 Nicolas Chuche
74 1 Nicolas Chuche
     RedmineDbUser "redmine"
75 1 Nicolas Chuche
     RedmineDbPass "password"
76 1 Nicolas Chuche
  </Location>
77 1 Nicolas Chuche
78 1 Nicolas Chuche
</pre>
79 1 Nicolas Chuche
80 17 Joachim Fritschi
h3. Testing the configuration:
81 1 Nicolas Chuche
82 17 Joachim Fritschi
After reloading apache conf, you can try to browse some repository with:
83 17 Joachim Fritschi
84 1 Nicolas Chuche
<pre>
85 1 Nicolas Chuche
svn ls http://my.svn.server/svn/myproject
86 4 Jean-Philippe Lang
</pre>
87 1 Nicolas Chuche
88 17 Joachim Fritschi
Any non-public repository should ask for a username and password.
89 4 Jean-Philippe Lang
90 17 Joachim Fritschi
To test the authentication that allows you redmine server to read all repositories:
91 1 Nicolas Chuche
92 17 Joachim Fritschi
Reading a private repository:
93 3 Jean-Philippe Lang
<pre>
94 17 Joachim Fritschi
svn ls http://my.svn.server/svn/myproject
95 17 Joachim Fritschi
</pre>
96 17 Joachim Fritschi
Try writing to the repository:
97 17 Joachim Fritschi
<pre>
98 17 Joachim Fritschi
svn mkdir http://my.svn.server/svn/myproject/testdir
99 17 Joachim Fritschi
</pre>
100 17 Joachim Fritschi
This should fail and ask for a password.
101 17 Joachim Fritschi
102 17 Joachim Fritschi
103 17 Joachim Fritschi
h3. optional LDAP Authentication
104 17 Joachim Fritschi
105 17 Joachim Fritschi
If you want to connect your LDAP authentication to Apache, you can install the Authen::Simple::LDAP perl module. I found that connecting to my LDAP server to authenticate with every request can be quite slow. I added the following to my configuration and had a significant performance increase. If you have configured an encrypted connection to the LDAP server you will need the IO::Socket::SSL module.
106 17 Joachim Fritschi
107 20 Stefan Stefansson
> *NOTE: the above wording is a little confusing. I attempt to clear up the issues I had with this in the following paragraph.*
108 20 Stefan Stefansson
> 
109 28 Rahul Panwar
> First of all, make sure that you have the Net::LDAP module installed as well. I installed Authen::Simple::LDAP through CPAN and found that nothing worked. Eventually I figured out that this was because the Authen::Simple::LDAP did not require the Net::LDAP module as a dependency but it is needed for our purpose here. I did this on CentOS and it seems that the Net::LDAP module can be installed via yum (@yum install perl-LDAP@) but the Authen::Simple::LDAP had to be installed via CPAN since there's no RPM for it in the CentOS repositories.
110 28 Rahul Panwar
> 
111 20 Stefan Stefansson
> My second point is related to the below Apache config. The @PerlLoadModule Authen::Simple::LDAP@ is actually not required for having users authenticated via LDAP. It will happen automatically if both of the above modules are installed. So there really is no difference between the config snippet below and the one above except for the @RedmineCacheCredsMax 50@ line which is probably a good idea although it can result in users that have been deleted or removed in redmine still getting access to the repositories, at least for a little while.
112 20 Stefan Stefansson
113 17 Joachim Fritschi
<pre>
114 8 Nicolas Chuche
   PerlLoadModule Apache::Redmine
115 17 Joachim Fritschi
   PerlLoadModule  Authen::Simple::LDAP
116 17 Joachim Fritschi
   # PerlLoadModule  IO::Socket::SSL
117 12 Todd Nine
   <Location /svn>
118 12 Todd Nine
     DAV svn
119 12 Todd Nine
     SVNParentPath "/var/svn"
120 12 Todd Nine
121 12 Todd Nine
     AuthType Basic
122 12 Todd Nine
     AuthName redmine
123 12 Todd Nine
     Require valid-user
124 12 Todd Nine
125 12 Todd Nine
     PerlAccessHandler Apache::Authn::Redmine::access_handler
126 12 Todd Nine
     PerlAuthenHandler Apache::Authn::Redmine::authen_handler
127 12 Todd Nine
  
128 12 Todd Nine
     ## for mysql
129 12 Todd Nine
     RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
130 12 Todd Nine
     ## for postgres
131 12 Todd Nine
     # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
132 12 Todd Nine
133 12 Todd Nine
     RedmineDbUser "redmine"
134 12 Todd Nine
     RedmineDbPass "password"
135 1 Nicolas Chuche
     #Cache the last 50 auth entries
136 12 Todd Nine
     RedmineCacheCredsMax 50
137 1 Nicolas Chuche
  </Location>
138 12 Todd Nine
</pre>
139 1 Nicolas Chuche
140 1 Nicolas Chuche
141 12 Todd Nine
h2. Apache configuration for Git repositories
142 12 Todd Nine
143 15 Jean-Philippe Lang
Now that reposman.rb can create git repositories, you can use Redmine.pm to access them the same way than subversion. 
144 12 Todd Nine
145 36 neil johnson
* [http://www.selectfactoring.co.uk/]
146 35 neil johnson
147 15 Jean-Philippe Lang
You first need to copy or link Redmine.pm to /usr/lib/perl5/Apache/Redmine.pm, then you add this configuration to apache : 
148 15 Jean-Philippe Lang
149 1 Nicolas Chuche
<pre>
150 33 neil johnson
Alias /git /var/git
151 32 Spenser Gilliland
152 33 neil johnson
PerlLoadModule Apache::Redmine
153 32 Spenser Gilliland
<Location /git>
154 33 neil johnson
  DAV on
155 33 neil johnson
156 8 Nicolas Chuche
  AuthType Basic
157 8 Nicolas Chuche
  Require valid-user
158 8 Nicolas Chuche
  AuthName "Git"
159 8 Nicolas Chuche
160 8 Nicolas Chuche
  PerlAccessHandler Apache::Authn::Redmine::access_handler
161 1 Nicolas Chuche
  PerlAuthenHandler Apache::Authn::Redmine::authen_handler
162 8 Nicolas Chuche
163 8 Nicolas Chuche
  RedmineDSN "DBI:mysql:database=redmine;host=localhost"
164 8 Nicolas Chuche
  RedmineDbUser "redmine"
165 32 Spenser Gilliland
  RedmineDbPass "password"
166 8 Nicolas Chuche
</Location>
167 8 Nicolas Chuche
168 8 Nicolas Chuche
Alias /git-private /var/git
169 8 Nicolas Chuche
170 8 Nicolas Chuche
<Location /git-private>
171 8 Nicolas Chuche
   Order deny,allow
172 8 Nicolas Chuche
   Deny from all
173 8 Nicolas Chuche
   <Limit GET PROPFIND OPTIONS REPORT>
174 8 Nicolas Chuche
      Options Indexes FollowSymLinks MultiViews
175 8 Nicolas Chuche
   Allow from 127.0.0.1
176 8 Nicolas Chuche
   </Limit>
177 8 Nicolas Chuche
</Location>
178 8 Nicolas Chuche
</pre>
179 8 Nicolas Chuche
180 8 Nicolas Chuche
To verify that you can access repository through Redmine.pm, you can use curl :
181 8 Nicolas Chuche
<pre>
182 8 Nicolas Chuche
% curl --netrc --location http://localhost/git/ecookbook/HEAD   
183 13 Thomas Pihl
ref: refs/heads/master
184 13 Thomas Pihl
</pre>
185 13 Thomas Pihl
186 22 Diego Oliveira
h2. Apache configuration for Mercurial repositories
187 22 Diego Oliveira
188 22 Diego Oliveira
Create a file caled "hgweb.config" in the same folder as "hgwebdir.cgi". This foder will be the root repository folder. Then edit the "hgweb.config" with something like this:
189 22 Diego Oliveira
190 22 Diego Oliveira
<pre>
191 22 Diego Oliveira
[paths]
192 22 Diego Oliveira
/=/path/to/root/repository/**
193 22 Diego Oliveira
194 22 Diego Oliveira
[web]
195 22 Diego Oliveira
allow_push = *
196 22 Diego Oliveira
allowbz2 = yes
197 22 Diego Oliveira
allowgz = yes
198 22 Diego Oliveira
allowzip = yes
199 22 Diego Oliveira
200 22 Diego Oliveira
</pre>
201 22 Diego Oliveira
202 22 Diego Oliveira
Follows the instructions to install Redmine.pm as described and configure your apache like this.
203 22 Diego Oliveira
204 22 Diego Oliveira
<pre>
205 22 Diego Oliveira
    RewriteEngine on
206 22 Diego Oliveira
    PerlLoadModule Apache2::Redmine
207 22 Diego Oliveira
    PerlLoadModule Authen::Simple::LDAP
208 22 Diego Oliveira
    ScriptAliasMatch ^/hg(.*)  /path/to/the/hgwebdir.cgi/$1
209 22 Diego Oliveira
    <Location /hg>
210 1 Nicolas Chuche
        AuthType Basic
211 22 Diego Oliveira
        AuthName "Mercurial"
212 22 Diego Oliveira
        Require valid-user
213 22 Diego Oliveira
214 22 Diego Oliveira
        #Redmine auth
215 32 Spenser Gilliland
        PerlAccessHandler Apache::Authn::Redmine::access_handler
216 32 Spenser Gilliland
        PerlAuthenHandler Apache::Authn::Redmine::authen_handler
217 32 Spenser Gilliland
        RedmineDSN "DBI:mysql:database=redmine;host=localhost"
218 32 Spenser Gilliland
        RedmineDbUser "DB_USER"
219 32 Spenser Gilliland
        RedmineDbPass "DB_PASSWD"
220 32 Spenser Gilliland
    </Location>
221 32 Spenser Gilliland
</pre>
222 22 Diego Oliveira
223 22 Diego Oliveira
224 22 Diego Oliveira
h2. Gotchas
225 13 Thomas Pihl
226 13 Thomas Pihl
If you run this in Phusion Passenger, make sure you don't turn PassengerHighPerformance on. If you do, the rewrites to catch subversion dav will be bypassed with some interesting dump in the log as a result.
227 13 Thomas Pihl
Example: 
228 1 Nicolas Chuche
> ActionController::RoutingError (No route matches "/svn/rm-code" with {:method=>:get}):
229 1 Nicolas Chuche
(if your repo are named rm-code)
230 27 Bill Dieter
231 36 neil johnson
* [http://www.junoblinds.co.uk/]