Configuring Groups and Permissions in Subversion

Sometimes you need to set different access permissions for users of your version control server, for example, to prevent some of them from accessing a particular repository.

To do this, you will need to create a file called svn-authz-access on the system (you can name it whatever you like) and specify the path to the file in the SVN configuration section in Apache.

Configuration

Open /usr/local/etc/apache22/httpd.conf for editing and add an entry for the file to the <location /svn> section:

AuthzSVNAccessFile /home/svn/svn-authz-access

You can find information about this section in my previous post, FreeBSD. Installing and Configuring Subversion

Let’s create and edit the svn-authz-access file

touch /home/svn/svn-authz-access
vi /home/svn/svn-authz-access

Groups

Groups are listed one per line, with usernames specified next to each group

[groups]
devel = adw0rd, vasac
tester = epsyl

The Root Section, Where All the Repositories Are

List the groups one per line, along with their permissions

[/]
@devel = r
* =

Repository Sections

[pyha-ru:/]
@devel = rw
* =

[example-com:/]
@devel = rw
@tester = rw
* =

@GROUP = - assigns permissions to the group GROUP.
* = - means everyone (other).
rw - read and write.
r - read
w - write

In the End, We Should Have Two Files

The httpd.conf file

<location /svn>
   DAV svn

   # разрешает выдавать перечень всех доступных хранилищ в папке SVNParentPath
   SVNListParentPath on
   SVNParentPath /home/svn/repos
   SVNPathAuthz off

   # включения базовой аутентификации, т.е. имя_пользователя/пароль
   AuthType Basic
   AuthName "Subversion repository"
   AuthUserFile /home/svn/svn-auth-file

   # предписывает, что только пользователям, предоставившим правильные имя_пользователя/пароль,
   # будет разрешён доступ к URL
   Require valid-user

   # Права и группы
   AuthzSVNAccessFile /home/svn/svn-authz-access

</location>

The svn-authz-access file

[groups]
devel = adw0rd, vasac
tester = epsyl

[/]
@devel = r
* =

[pyha-ru:/]
@devel = rw
* =

[example-com:/]
@devel = rw
@tester = rw
* =

Restart Apache

apachectl restart

Well, that’s it—we’ve now set up separate access permissions :)