svn使用openldap验证apache访问方式

启用svn服务器的sasl验证机制

1、安装cyrus-sasl认证包
# yum install -y *sasl*
# rpm -qa|grep sasl
cyrus-sasl-2.1.23-15.el6_6.2.x86_64
ruby-saslwrapper-0.14-1.el6.x86_64
cyrus-sasl-md5-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-lib-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-devel-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-gssapi-2.1.23-15.el6_6.2.x86_64
saslwrapper-0.14-1.el6.x86_64
cyrus-sasl-sql-2.1.23-15.el6_6.2.x86_64
python-saslwrapper-0.14-1.el6.x86_64
cyrus-sasl-ldap-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-ntlm-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-plain-2.1.23-15.el6_6.2.x86_64
saslwrapper-devel-0.14-1.el6.x86_64

2、修改sasl认证模式为shadow
# cp /etc/sysconfig/saslauthd /etc/sysconfig/saslauthd.bak.$(date +%F%T)
[root@node5 config]# ll /etc/sysconfig/saslauthd*
-rw-r–r– 1 root root 553 Feb 27  2015 /etc/sysconfig/saslauthd
-rw-r–r– 1 root root 553 Jul  1 21:14 /etc/sysconfig/saslauthd.bak.
-rw-r–r– 1 root root 553 Jul  1 21:14 /etc/sysconfig/saslauthd.bak.2016-07-0121:14:19
[root@node5 config]# sed -i ‘s#MECH=pam#MECH=shadow#g’ /etc/sysconfig/saslauthd
[root@node5 config]# grep -i mech /etc/sysconfig/saslauthd
# Mechanism to use when checking passwords.  Run “saslauthd -v” to get a list
# of which mechanism your installation was compiled with the ablity to use.
MECH=shadow
# Options sent to the saslauthd. If the MECH is other than “pam” uncomment the next line.

3、配置ldap方式验证用户
# /etc/init.d/saslauthd restart
Stopping saslauthd:                                        [FAILED]
Starting saslauthd:                                        [  OK  ]
[root@node5 config]# testsaslauthd -ulily -plily
0: NO “authentication failed”
[root@node5 config]# grep lily /etc/passwd
[root@node5 config]# id lily
id: lily: No such user
[root@node5 config]# useradd lily
[root@node5 config]# passwd lily
Changing password for user lily.
New password: 
BAD PASSWORD: it is too short
BAD PASSWORD: is too simple
Retype new password: 
passwd: all authentication tokens updated successfully.
[root@node5 config]# testsaslauthd -ulily -plily
0: OK “Success.”
# testsaslauthd -utom -ptom
0: NO “authentication failed”

修改验证模式为ldap
# sed -i ‘s#MECH=shadow#MECH=ldap#g’ /etc/sysconfig/saslauthd
[root@node5 config]# grep -i mech /etc/sysconfig/saslauthd
# Mechanism to use when checking passwords.  Run “saslauthd -v” to get a list
# of which mechanism your installation was compiled with the ablity to use.
MECH=ldap
# Options sent to the saslauthd. If the MECH is other than “pam” uncomment the next line.

编辑saslauthd.conf文件，默认不存在，需要自己添加
vim /etc/saslauthd.conf 加入如下内容：
ldap_servers: ldap://chinasoft.com/
ldap_bind_dn: cn=admin,dc=chinasoft,dc=com
ldap_bind_pw: chinasoft
ldap_search_base: ou=People,dc=chinasoft,dc=com
ldap_filter: uid=%U
ldap_password_attr: userPassword

# /etc/init.d/saslauthd restart
Stopping saslauthd:                                        [  OK  ]
Starting saslauthd:                                        [  OK  ]

# testsaslauthd -ulily -plily
0: OK “Success.”
[root@node5 config]# testsaslauthd -utom -ptom
0: OK “Success.”

4、配置svn通过ldap验证
在ldap服务器中添加svn.conf文件，默认没有该文件，需要自己添加
# vim /etc/sasl2/svn.conf
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN

svn服务器中修改svn服务器配置
# cd /application/svndata/sadoc/conf/
# sed -i ‘s@# use-sasl = true@use-sasl = true@g’ svnserve.conf
# grep use-sasl svnserve.conf
use-sasl = true
[root@node2 conf]# /etc/init.d/svnserve stop
[root@node2 conf]# pkill svnserve
[root@node2 conf]# lsof -i :3690
启动服务
[root@node2 conf]# svnserve -d -r /application/svndata/
[root@node2 conf]# lsof -i :3690
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
svnserve 35415 root    3u  IPv4 557724      0t0  TCP *:svn (LISTEN)

修改svn服务器apache配置
# vim /etc/httpd/confhttpd.conf

<Location /svn>
    # SVN配置
    DAV svn
    SVNPath /application/svndata/sadoc/
    SVNListParentPath on
    AuthType Basic
    AuthName “svn for project”
    AuthUserFile /application/svnpasswd/webpasswd
    AuthzSVNAccessFile /application/svnpasswd/authz
    Satisfy all
    Require valid-user

    # 在ldap找不到账号的情况下可以使用其它的认证方式(如,密码文件)
    AuthzLDAPAuthoritative off
    # openLDAP的管理账户
    AuthLDAPBindDN “cn=admin,dc=chinasoft,dc=com”
    AuthLDAPBindPassword chinasoft

    AuthBasicProvider ldap
    # 认证数据来源：”ou=People,dc=chinasoft,dc=com” 下所有子entity的uid作为认证用户名
    AuthLDAPURL “ldap://192.168.8.43:389/ou=People,dc=chinasoft,dc=com?uid?sub?(objectClass=*)”

    # 设置目录权限，实现列表所有工程目录
    Options Indexes FollowSymLinks
    Order allow,deny
    Allow from all
</Location>

查看错误日志定位问题：
# tail /var/log/httpd/error_log
[Tue Jul 05 14:40:18 2016] [error] [client 192.168.50.122] user lily: authentication failure for “/svn/”: Password Mismatch
[Tue Jul 05 14:40:23 2016] [notice] caught SIGTERM, shutting down
[Tue Jul 05 14:40:23 2016] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue Jul 05 14:40:23 2016] [notice] Digest: generating secret for digest authentication …
[Tue Jul 05 14:40:23 2016] [notice] Digest: done
[Tue Jul 05 14:40:23 2016] [notice] Apache/2.2.15 (Unix) DAV/2 SVN/1.6.11 configured — resuming normal operations
[Tue Jul 05 14:40:26 2016] [error] [client 192.168.50.122] user lily: authentication failure for “/svn/”: Password Mismatch
[Tue Jul 05 14:40:38 2016] [error] [client 192.168.50.122] user lily: authentication failure for “/svn/”: Password Mismatch
[Tue Jul 05 14:40:40 2016] [error] [client 192.168.50.122] File does not exist: /var/www/html/favicon.ico
[Tue Jul 05 14:40:45 2016] [error] [client 192.168.50.122] user lily: authentication failure for “/svn/”: Password Mismatch

svn通过ldap验证小结：
1.配置成功saslauthd
2.在ldap服务器中配置/etc/sasl2/svn.conf
3.配置好svn服务，并且开启sasl支持，重启svn

4.配置authz授权ldap用户访问项目

5.配置httpd.conf授权通过ldap访问

注意：
通过ldap认证的用户，必须在svn和ldap中添加相同账号，并且密码必须一致，否则无法访问原文链接：https://www.cnblogs.com/reblue520/p/6239772.html
本文来源 爱码网，其版权均为 原网址 所有 与本站无关，文章内容系作者个人观点，不代表 本站 对观点赞同或支持。如需转载，请注明文章来源。