Install necessary packages first.
$ yum install subversion mod_dav_svn mod_ldap python-ldap
Prepare configuration for Apache. Create a file /etc/httpd/conf.d/subversion.conf and put the content bellow into it. Change location, physical path on disk, Active Directory LDAP server and bind credentials to your particular environment.
RewriteEngine on
RewriteCond %{REQUEST_URI} ^/$
RewriteCond %{HTTP_USER_AGENT} !^SVN/
RewriteRule ^(.*/)$ %0/ [R=301,L]
<Location /svn>
DAV svn
SVNParentPath /var/www/svn
SVNListParentPath on
SVNCacheTextDeltas off
SVNCacheFullTexts off
SVNAllowBulkUpdates on
SVNIndexXSLT "/svnindex.xsl"
AuthzSVNAccessFile /etc/subversion/access.conf
Options Indexes
AuthBasicProvider ldap
AuthName "Memos Subversion Repositories"
AuthType Basic
AuthLDAPBindDN "CN=svn_user,OU=Service Accounts,DC=domain,DC=com"
AuthLDAPBindPassword svn_user_password
AuthLDAPURL "ldap://global_catalog.domain.com:3268/OU=People,DC=domain,DC=com?sAMAccountName?sub?(objectCategory=person)"
Require valid-user
ExpiresActive on
ExpiresDefault access
</Location>
Create a directory where Subversion data will be stored if it does not already exist:
$ mkdir -p /var/www/svn
Change the permissions of this directory to be owned (or at least writeable by Apache):
$ chown apache:apache /var/www/svn
Start Apache
$ systemctl start httpd
Now you need to setup access permissions. There is a catch. There is no simple way how to use Active Directory groups, so we need to synchronize groups from AD to local authz configuration file which we have already configured in Apache confiuration before. To do it we will use sync_ldap_groups_to_svn_authz.
Create authz file and put to the top users which will have access to all repositories (such administrators with read write access or continuos intergration user with read only access). Then put particular repositories permissions. You can already add groups from Active Directory. At the end will be part of the config file dedicated to groups definitions and at the very end the comment we will use to find out where the grous definition start. See:
[/]
admin = rw
ci = r
[repository1:/]
user1 = rw
@SVN_GROUP1 = rw
[groups]
### Start generated content: LDAP Groups to Subversion Authz Groups Bridge ###
Now dowload sync_ldap_groups_to_svn_authz.py and create synchronization script (adjust the details within).
#!/bin/sh
SVN_CONF_DIR=/etc/subversion
JW_TOOLS_DIR=/opt
# truncate the access file after the generated-content tag
perl -0777 -pe 's/\n\n\n### Start generated content.*//s' \
< $SVN_CONF_DIR/access.conf \
> $SVN_CONF_DIR/access.conf.tmp
echo "### Start generated content: LDAP Groups to Subversion Authz Groups Bridge ###" >> $SVN_CONF_DIR/access.conf.tmp
# append the latest LDAP group configuration
$JW_TOOLS_DIR/sync_ldap_groups_to_svn_authz.py \
--quiet --url="ldap://dc1.memos.cz:3268" \
--bind-dn="CN=SVN,OU=Service Accounts,OU=People,DC=memos,DC=cz" --bind-password="REV-Code-673" --base-dn="OU=SVN Groups,OU=Groups,DC=memos,DC=cz" \
--userid_attribute="sAMAccountName" | grep -v '^\[groups\]' | grep -v '^\#' | grep -v '^$' | sort >> $SVN_CONF_DIR/access.conf.tmp
mv -f $SVN_CONF_DIR/access.conf.tmp $SVN_CONF_DIR/access.conf
Run this script manually or from cron.
