Version Control with Subversion - Login

Server Configuration[groups]examplehost = host.example.com[examplehost]ssl-client-cert-file = /path/to/my/cert.p12ssl-client-cert-password = somepasswordOnce you've set the ssl-client-cert-file and ssl-client-cert-password variables,the Subversion client can automatically respond to a client certificate challengewithout prompting you. 6Authorization OptionsAt this point, you've configured authentication, but not authorization. Apache is able tochallenge clients and confirm identities, but it has not been told how to allow or restrict accessto the clients bearing those identities. This section describes two strategies for controllingaccess to your repositories.Blanket access controlThe simplest form of access control is to authorize certain users for either read-only accessto a repository or read/write access to a repository.You can restrict access on all repository operations by adding the Require valid-userdirective to your block. Using our previous example, this would mean thatonly clients that claimed to be either harry or sally and that provided the correct passwordfor their respective username would be allowed to do anything with the Subversionrepository:DAV svnSVNParentPath /var/svn# how to authenticate a userAuthType BasicAuthName "Subversion repository"AuthUserFile /path/to/users/file# only authenticated users may access the repositoryRequire valid-userSometimes you don't need to run such a tight ship. For example, Subversion's own sourcecode repository at http://svn.collab.net/repos/svn allows anyone in the world to performread-only repository tasks (such as checking out working copies and browsing the repositorywith a web browser), but restricts all write operations to authenticated users. To do thistype of selective restriction, you can use the Limit and LimitExcept configuration directives.Like the Location directive, these blocks have starting and ending tags, and youwould nest them inside your block.The parameters present on the Limit and LimitExcept directives are HTTP requesttypes that are affected by that block. For example, if you wanted to disallow all access toyour repository except the currently supported read-only operations, you would use theLimitExcept directive, passing the GET, PROPFIND, OPTIONS, and REPORT requesttype parameters. Then the previously mentioned Require valid-user directive wouldbe placed inside the block instead of just inside the block.6 More security-conscious folk might not want to store the client certificate password in the runtime servers file.176