Ndtyjky

I have installed and configured a subversion in Linux7 and from the front end I am using svn tortoise. From server lever, I want to integrate my subversion with AD.

I have two repositories inside /u01/ciroot/subversion, like DEV_REPO and PROD_REPO.

Also in AD I have two groups; one is OBIEE_DEV and another is OBIEE_PROD. Now I want members of group OBIEE_DEV to access the repository DEV_REPO and members of group OBIEE_PROD
to access the repository DEV_REPO and PROD_REPO (both). So in my AD, under group OBIEE_DEV, I have user1 and user2 both there, but in the AD group OBIEE_PROD I only have user2.

These things are placed properly. But in /etc/httpd/conf.d/subversion.conf file how should I declare this? Below is my subversion.conf file where right now only one group entry is mentioned which is OBIEE_DEV, i want to add entry for group OBIEE_PROD too here. Please guide me how to achieve this.

<pre>

    <location /svn>

        DAV svn

        SVNParentPath /u01/ciroot/subversion

        AuthType Basic

        AuthBasicProvider ldap

        AuthName "Root Repo"

        AuthLDAPURL "ldap://ldap.server.com:389/DC=macgroup,DC=local?sAMAccountName?sub?(&(ObjectClass=*)(memberOf=CN=OBIEE_DEV,OU=OBIEE,OU=Security,OU=Groups,OU=Global Resources,DC=MACGROUP,DC=LOCAL))" STARTTLS



        AuthLDAPBindDN "CN=oidkerbt,OU=Service Accounts,OU=Users,OU=Global 

        Resources,DC=macgroup,DC=local"

        AuthLDAPBindPassword password_of_ldap_server

        Require valid-user

    </location>

</pre>

First, read the box titled "Do You Really Need Path-Based Access Control?" here: http://svnbook.red-bean.com/en/1.7/svn.serverconfig.pathbasedauthz.html

But if you still decide you want to do this, that link should help you set this up. But basically, create two location entries: one for each repository. You point each at the group at the AD group that grants that permission.

If you want people in the OBIEE_PROD group to have access to the DEV_REPO too, then just add the OBIEE_PROD group to your OBIEE_DEV group in AD.

This is an example, but I can't guarantee this will work exactly as-is:

<location /svn/DEV_REPO>

    DAV svn

    SVNParentPath /u01/ciroot/subversion

    AuthType Basic

    AuthBasicProvider ldap

    AuthName "Root Repo"

    AuthLDAPURL "ldap://ldap.server.com:389/DC=macgroup,DC=local?sAMAccountName?sub?(&(ObjectClass=*)(memberOf=CN=OBIEE_DEV,OU=OBIEE,OU=Security,OU=Groups,OU=Global Resources,DC=MACGROUP,DC=LOCAL))" STARTTLS



    AuthLDAPBindDN "CN=oidkerbt,OU=Service Accounts,OU=Users,OU=Global 

    Resources,DC=macgroup,DC=local"

    AuthLDAPBindPassword password_of_ldap_server

    Require valid-user

</location>

<location /svn/PROD_REPO>

    DAV svn

    SVNParentPath /u01/ciroot/subversion

    AuthType Basic

    AuthBasicProvider ldap

    AuthName "Root Repo"

    AuthLDAPURL "ldap://ldap.server.com:389/DC=macgroup,DC=local?sAMAccountName?sub?(&(ObjectClass=*)(memberOf=CN=OBIEE_PROD,OU=OBIEE,OU=Security,OU=Groups,OU=Global Resources,DC=MACGROUP,DC=LOCAL))" STARTTLS



    AuthLDAPBindDN "CN=oidkerbt,OU=Service Accounts,OU=Users,OU=Global 

    Resources,DC=macgroup,DC=local"

    AuthLDAPBindPassword password_of_ldap_server

    Require valid-user

</location>