Version Control with Subversion - Login

Server Configurationtp://asg.web.cmu.edu/sasl/sasl-library.html.Normally, when a subversion client connects to svnserve, the server sends a greeting thatadvertises a list of the capabilities it supports, and the client responds with a similar list ofcapabilities. If the server is configured to require authentication, it then sends a challengethat lists the authentication mechanisms available; the client responds by choosing one ofthe mechanisms, and then authentication is carried out in some number of round-trip messages.Even when SASL capabilities aren't present, the client and server inherently knowhow to use the CRAM-MD5 and ANONYMOUS mechanisms (see the section called“Built-in Authentication and Authorization”). If server and client were linked against SASL, anumber of other authentication mechanisms may also be available. However, you'll need toexplicitly configure SASL on the server side to advertise them.Authenticating with SASLTo activate specific SASL mechanisms on the server, you'll need to do two things. First,create a [sasl] section in your repository's svnserve.conf file with an initial key-valuepair:[sasl]use-sasl = trueSecond, create a main SASL configuration file called svn.conf in a place where theSASL library can find it—typically in the directory where SASL plug-ins are located. You'llhave to locate the plug-in directory on your particular system, such as /usr/lib/sasl2/or /etc/sasl2/. (Note that this is not the svnserve.conf file that lives within a repository!)On a Windows server, you'll also have to edit the system registry (using a tool such as regedit)to tell SASL where to find things. Create a registry key named[HKEY_LOCAL_MACHINE\SOFTWARE\Carnegie Mellon\Project Cyrus\SASLLibrary], and place two keys inside it: a key called SearchPath (whose value is a pathto the directory containing the SASL sasl*.dll plug-in libraries), and a key called Conf-File (whose value is a path to the parent directory containing the svn.conf file you created).Because SASL provides so many different kinds of authentication mechanisms, it would befoolish (and far beyond the scope of this book) to try to describe every possible server-sideconfiguration. Instead, we recommend that you read the documentation supplied in thedoc/ subdirectory of the SASL source code. It goes into great detail about every mechanismand how to configure the server appropriately for each. For the purposes of this discussion,we'll just demonstrate a simple example of configuring the DIGEST-MD5 mechanism.For example, if your subversion.conf (or svn.conf) file contains the following:pwcheck_method: auxpropauxprop_plugin: sasldbsasldb_path: /etc/my_sasldbmech_list: DIGEST-MD5you've told SASL to advertise the DIGEST-MD5 mechanism to clients and to check userpasswords against a private password database located at /etc/my_sasldb. A systemadministrator can then use the saslpasswd2 program to add or modify usernames andpasswords in the database:$ saslpasswd2 -c -f /etc/my_sasldb -u realm username165