Svn – 403 Forbidden When Using AuthzSVNAccessFile

svn

I've had a nicely functioning svn server running on windows that uses Apache for access. In the original setup every user had access to all repositories, but I recently needed the ability to grant a user only access to one repository. I uncommented the AuthzSVNAccessFile line in my httpd.conf file and pointed it to an accessfile and setup the access file, but I get a 403 Forbidden when I go to mydomain.com/svn . If I recomment out this line then things work again. I also made sure I uncommented the LoadModule authz_svn_module and verified that it was point to the correct file.

Below is the Location section of my httpd.conf and my svnaccessfile

httpd.conf (location section only)

<Location /svn>
    DAV svn
    SVNParentPath C:\svn
    SVNListParentPath on
    AuthType Basic
    AuthName "Subversion repositories"
    AuthUserFile passwd
    Require valid-user
    AuthzSVNAccessFile svnaccessfile
</Location>

(I want a more complex policy in the long run but just did this to test the file out)
svnaccessfile

[svn:/]
* = rw

I have also tried just the below for the svnaccessfile.

[/]
* = rw

I also restart the service after each change just to make sure it is taken.

Best Answer

It looks like I have resolved the issue by changing the start of the Location tag to

The difference being the trailing /

Related Solutions

Svn – How Do I Restrict Repository Access via WebSVN

The issue is probably relating to the splitting of configuration between two location directives, but I'm not sure.

Rather than defining permissions in two places (apache config and the authz file), just define them in the authz file. Like so:

httpd.conf

<Location /svn>
  DAV svn
  SVNParentPath /var/lib/svn/repository

  Require valid-user
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /path/to/.htpasswd

  SVNPathAuthz on
  AuthzSVNAccessFile /path/to/svn.authz
</Location>

svn.authz

[groups]
sysadmins = joebloggs jimsmith mickmurphy

# By default, nobody has any permissions
[/]
* = 

# sysadmins get access to the sysadmin repository
[sysadmin:/]
@sysadmins = rw

You would need the appropriate users in the htpasswd file too, obviously.

Svn – How does AuthzSVNAccessFile work

Does the error only occur for user doe on both repositories? Or does it fail for grig on the second repository? Assuming it fails for all users, and assuming the error isn't in the AuthUserFile and the SVNParentPath is correct, I think you need to add a default access rule for all of your repositories.

[/]
* = r

[first:/]
doe = rw

[second:/]
doe = rw
grig = rw

Or you could put users doe and grig into a group and do it as follows:

[groups]
secondteam = doe, grig

[/]
* = r

[first:/]
doe = rw

[second:/]
@secondteam = rw

You mention that you would like to better understand how the AuthzSVNAccessFile is supposed to work. I recommend reading this tutorial. A full path-based authorization file example from that tutorial for supporting multiple repositories is below:

[groups]
admin = john, kate
devteam1 = john, rachel, sally
devteam2 = kate, peter, mark
docs = bob, jane, mike
training = zak

# Default access rule for ALL repositories
# Everyone can read, admins can write, Dan German is excluded.
[/]
* = r
@admin = rw
dangerman =

# Allow developers complete access to their project repos
[proj1:/]
@devteam1 = rw
[proj2:/]
@devteam2 = rw
[bigproj:/]
@devteam1 = rw
@devteam2 = rw
trevor = rw

# Give the doc people write access to all the docs folders
[/trunk/doc]
@docs = rw

# Give trainees write access in the training repository only
[TrainingRepos:/]
@training = rw

Related Topic