Before reading this article, please make sure you already know the basics of Subversion server administration, know the configuration of svnserve or Apache, and know how to set up users and passwords. For the configuration of svnservee, see our "Subversion Quick Start Tutorial" and "Building a Secure Version Control Environment with Apache and Subversion". For some details, refer to "Version Control with Subversion".
As a configuration administrator, you need to manage user permissions. This article mainly introduces the use of Subversion's authorization file "authz-db". At the same time, for the clarity of the description, I first clarify some concepts.
In many cases, one library is not enough. We will build multiple libraries by project, by previous programming language category, or by division of labor, and we want to use the same set of authentication and authorization schemes. So this article is based on this situation to make an introduction.
1. The terms Authentication and Authorization
are often used together. Among them, authentication means to identify the identity of the user. The most common way is to use the user name and password. Authorization is to determine whether the user has the authority to perform a certain operation. The "authz-db" file is provided in Subversion to implement path-based authorization, that is, to determine whether the user has the authority to operate the corresponding path. After Subversion 1.3, the "authz-db" file can be used by svnserve like Apache.
2. Configuration file under SVN Serve
This article uses Subversion 1.7.9 http://sourceforge.net/projects/win32svn/files/1.7.9/apache22/
Because this article takes svnserve as an example, first introduce the structure of the multi-version library directory:
─Repo
├─JavaRepo
│ ├─conf
│ ├─db
│ │ ├─revprops
│ │ │ └─0
│ │ ├─revs
│ │ │ └─0
│ │ tr─transactions
│ │ └─txn-protorevs
│ ├ hooks
l
└─locks └─PHPRepo
├─conf
├─db
│ ├─revprops
│ │ └─0
│ re─revs
│ │ └─0
│ ├─transactions
│ └─txn-protorevs
├─hooks
└─locks
authz and passwd under JavaRepo/conf and authz and passwd under PHPRepo/conf Copy a set of (authz, passwd) in another directory to the Repo directory, and delete the rest.
Modify the configuration file conf/svnserve.conf separately
### The password-db option controls the location of the password ### database file. Unless you specify a path starting with a /, ### the file's location is relative to the directory containing ### this configuration file. ### If SASL is enabled (see below), this file will NOT be used. ### Uncomment the line below to use the default password file. password-db = ../../passwd ### The authz-db option controls the location of the authorization ### rules for path-based access control. Unless you specify a path ### starting with a /, the file's location is relative to the the ### directory containing this file. If you don't specify an ### authz-db, no path-based access control is done. ### Uncomment the line below to use the default authorization file. authz-db = ../../authz
Point the configuration file to the upper-level directory
Ensure that admin can read and write any library; java developers can only read and write JavaRepo; php developers can only read and write PHPRepo, and testers have readable permissions for both libraries; anonymous users cannot access any library
modify passwd
[users] #php development ch = ch0126 qh = qh0126 #java development hb = hb0126 qs = qs0126 #test ry = ry0126
modify authz
[groups] admin_group = chaohai java_group = haibao,qiushui php_group = qinghai test_group = ruoye # Specify that all repositories are read-only by default, and the admin_group group can read and write [/] * = none @admin_group = rw # Specify permissions to the root directory of the repository JavaRepo [JavaRepo: /] # Unauthorized users have no permissions * = none @admin_group = rw @java_group = rw @test_group = r # Specify permissions to the root directory of the repository PHPRepo [PHPRepo:/] # Unauthorized users have no permissions * = none @admin_group = rw @php_group = rw @test_group = r
create windows service
sc create SVNService binpath= "D:\SoftwareDevelopment\Subversion\svn-win32-1.7.9\bin\svnserve.exe --service -r D:\Repositories\SVN\Repo" displayname= "SVNService" depend= Tcpip start= auto
SC SVNService start