SVN parent listing returns 403 when using authz

Question

I have an svn set up at svn.example.com

I have the SVNParentPath set to list all repos in a directory.

When I enable my AuthzSVNAccessFile the listing page returns a 403 while I can correctly access repos directly at svn.example.com/repo name.

Apache conf:

<VirtualHost *:80> ServerName svn.example.com DocumentRoot /var/www/svn <Location /> DAV svn AuthType Basic AuthName "svn.example.com" AuthUserFile /etc/apache2/svn/users.passwd AuthzSVNAccessFile /etc/apache2/svn/authz SVNParentPath /var/svn SVNListParentPath on Require valid-user </Location> </VirtualHost> 

Authz File:

[groups] admin = user1. user2, user3 [/] @admin = rw 

Here is what I see in the error log;

The URI does not contain the name of a repository. [403, #190001] Could not fetch resource information. [500, #0] Could not open the requested SVN filesystem [500, #2] Could not open the requested SVN filesystem [500, #2] 

Access Log

svn.example.com:80 *myIP* - user1 [18/Nov/2010:13:56:53 +0000] "GET / HTTP/1.1" 403 274 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7" 

Answer 1

On further review, I second iiegn's answer. I was able to remove the problem with SVN 1.6.13 by adding a trailing slash and an alias without the slash like the article suggests.

---

Previous Response:

I found an answer to this on StackOverflow at https://stackoverflow.com/questions/488778/how-do-i-list-all-repositories-with-the-svnparentpath-directive-on-apachesvn, and it states to add:

SVNListParentPath On 

This matches the what's at http://svnbook.red-bean.com/en/1.5/svn.ref.mod_dav_svn.conf.html, where it states:

SVNListParentPath On|Off

When set to On, allows a GET of SVNParentPath, which results in a listing of all repositories under that path. The default setting is Off.

This should fix the 403 problem.

Answer 2

...have you tried a <Location /svn/> - with trailing slah! there: http://www.svnforum.org/2017/viewtopic.php?t=6443 people seem to have solved the problem for the 'non root-dir case.'

...then, at least, you know where to look further (mod-rewrite...?).

Answer 3

AuthzSVNAnonymous On AuthzSVNNoAuthWhenAnonymousAllowed On Satisfy Any 

Firstly you need the Satisfy Any directive, also you will need the Anonymous lines if running a combined open / auth repo (i.e. I have some areas containing open source some closed source).

As I blogged here on upgrade: http://www.saiweb.co.uk/linux/mod_authz_svn-mod_dav_svn-prompting-for-password

Verify that SVNParentPath /var/svn path exists at /var/svn and it is accessible and writable by the apache use, chances are you left this owned by root:root chown -R apache:apache /var/svn

Answer 4

I'm having the same issue, hosting Subversion on its own subdomain. It seems like there needs to be a configuration like [], but that seems to just cause a silent error, rendering the file to be ignored altogether. Here's the jist of a workaround that I can't get to work, but might give you some ideas:

1. Redirect / to /index/ (or whatever suits your taste)
2. Duplicate the <location /> section and rename the first one to <location /index/> section
3. Add a rewrite rule matching /index/* to redirect to /$1
4. Add an [/index/] section to the authz file

I spent a few minutes trying this out, but didn't have much luck. I'll update this answer if I find a way to make that work, or a better solution.

Answer 5

I had the same problem and found the following workaround. Main idea is to not apply "AuthzSVNAccessFile" to the root but apply for the rest. Works for me in apache2.2 (Ubuntu Server 12.04).

<VirtualHost *:80> ... <Location /> ... </Location> <Location /.+> AuthzSVNAccessFile /path/to/the/access/file </Location> </VirtualHost> 

Update (full config):

<VirtualHost *:80> ServerAdmin [email protected] ServerName svn.company.lan <Location /> # Enable Subversion DAV svn # Directory containing all repository for this path SVNListParentPath on SVNParentPath /opt/subversion # LDAP Authentication & Authorization is final; do not check other databases AuthzLDAPAuthoritative on AuthBasicProvider ldap # Do basic password authentication in the clear AuthType Basic # The name of the protected area or "realm" AuthName "Subversion Repository" # The LDAP query URL # Format: scheme://host:port/basedn?attribute?scope?filter # The URL below will search for all objects recursively below the basedn # and validate against the sAMAccountName attribute AuthLDAPURL "ldap://dc1.company.com/dc=serv,dc=company,dc=com?sAMAccountName?sub" AuthLDAPBindDN "CN=svn1user,OU=ou1,DC=company,DC=com" AuthLDAPBindPassword "PASS" # Require authentication for this Location Require valid-user </Location> # <LocationMatch /.+> is a really dirty trick to make listing of repositories work (http://d.hatena.ne.jp/shimonoakio/20080130/1201686016) <LocationMatch /.+> AuthzSVNAccessFile /opt/subversion/subversion.perm </LocationMatch> </VirtualHost>