Subversion Authz

| 2 Comments

I've been doing a lot of work with Subversion lately, both in my day job, and in some open source projects I work with (specifically Blastwave.org).  Subversion is great in a lot of respects -- I especially like that it is able to utilize all of the excellent authentication, authorization, and other features of Apache 2.2.  One thing I am unhappy about, however, is the static authz file which mod_authz_svn uses to limit read/write access to the database.  Why a flat file? Why, oh why?

Well, I have a couple of ideas about what to do here.  There are two projects I'm considering, both of which migh be useful in different situations:

  1. Modify (or rewrite) mod_authz_svn to optionally use the features of Apache 2.2 mod_dbd.  Mod_dbd is a module which provides SQL server connection pooling functionality to other modules.  Admins are able to specify db connections in httpd.conf, and client modules can then prepare and execute queries against the data source.  If rewritten, mod_authz_svn could then leverage information stored in a SQLite, MySQL, or PostgreSQL database, which would make writing authz admin applications a lot easier (in my opinion, anyway -- managing concurrent access to files sucks).

    This option would likely take me the most time, as I've never written an Apache 2.x module in C before.  The closest I've been to writing Apache modules is mod_perl 2.x.  I'm also crippled in this effort by the lack of documentation and examples I've been able to find on mod_dbd, but one good example is all it takes.

  2. Standalone authz daemon.  This daemon would open a named pipe, and monitor it.  Apache mod_authz_svn would then open the pipe, and be served information by the daemon.  I implemented something similar to this in the past, having syslog log to a pipe, putting remote host logs coming in via the local network into separate files.  This *should* work the same way in principle, depending on how mod_authz_svn treats the pipe.  When the pipe is opened, and the authz module reads, the daemon can retrieve information from anywhere -- database, network service, another process, or anything.

    Assuming that this works out technically, this project could be the shortest path to flee the current static file format.  The daemon would provide a good opportunity to create the database schema and get it working properly before worrying about Apache authz.

2 Comments

Have you made any progress on this front? I have run into the exact same issues...
Please email me if you have - i will probably not return to this list.

Thanks

running into subversion auth problems too. They can be a real pain.

Categories

Pages

About this Entry

This page contains a single entry by Cory published on March 24, 2006 4:27 PM.

On infrequent blogging was the previous entry in this blog.

Insanely Absurd is the next entry in this blog.

Find recent content on the main index or look in the archives to find all content.