Zentyal 3.3, Subversion, Apache, Dav, LDAP Authentication on Ubuntu Server 12.04

[ajohan]

Good Day everyone,

I have been tasked with configuring a SVN server. The box is running Zentyal that was installed on top of Ubuntu Server 12.04. The users are required to be managed via the Zentyal web interface and also against the domain (LDAP). Following is what I did to make it work. I spent many hours searching and reading to get the configuration working and would like to share my experiences with hopes that it may be useful for others attempting the same configuration. I would to thank all those who have shared the previous experiences which help and guided me to get a successful configuration working, there are too many to list down.

Machine Setup

- Ubuntu server 12.04
- Zentyal 3.3
- all patches and updates have been applied

Zentyal Setup

Zentyal Modules installed:

sysinfo network firewall audit ca dns events global logs monitor ntp objects openvpn remoteservices samba services software users webadmin webserver

Domain Configuration

- Created a security group called SVNUser. Users allowed to access the SVN repo is added to this group (See the attached image)
- Created new user accounts and added to the SVNUser group

Pre-requisites

- Ensure that the webserver module is installed for access to apache2

- Ensure that there is a domain admin account that can be used to access the LDAP. You can do this by adding the account to the Domain Admins group. For my setup i created an account called: domainadmin

Installation Steps

- Install svn:

Code: [Select]

sudo apt-get install subversion
- Install apache svn:

Code: [Select]

sudo apt-get install libapache2-svn
- Enable LDAP integration:

Code: [Select]

sudo a2enmod authnz_ldap
- Create the svn root directory:

Code: [Select]

sudo mkdir /var/svn
- Create the svn repository directory:

Code: [Select]

sudo mkdir /var/svn/repository
- Change the owner and group of the svn directory:

Code: [Select]

sudo chown -Rv www-data:www-data /var/svn/repository
- Set permissions to the repo folder:

Code: [Select]

sudo chmod -R g+rws /var/svn/repository
- Initialize the svn folder:

Code: [Select]

sudo svnadmin create /var/svn/repository
- Update the correct permissions again:

Code: [Select]

sudo chmod -R g+rws /var/svn/repository
Apache DAV Configuration

- Edit the following file:

Code: [Select]

sudo vi /etc/apache2/mods-available/dav_svn.conf
- Since I prefer to have things nice and clean I removed all the existing lines. You can change the location on the first line to anything that your prefer. For me I used: /svn.

Contents of /etc/apache2/mods-available/dav_svn.conf:

Code: [Select]

<Location /svn>
   DAV svn
   SVNParentPath /var/svn
   SVNListparentPath on

   AuthType Basic
   AuthName "SVN"
   AuthBasicProvider ldap

   AuthzLDAPAuthoritative on

   # The LDAP Url was the one that was giving me a lot of grief.
   # Initially I used port 389 and the authentication failed.
   # In one of the web pages i saw they used port 390 and when i changed it worked immediately.
   AuthLDAPURL "ldap://127.0.0.1:390/ou=Users,dc=office,dc=lan?uid"
   AuthLDAPBindDN "uid=domainadmin,ou=Users,dc=office,dc=lan"
   AuthLDAPBindPassword domainadmin-password

   # enable line below for any authenticated user
   # Require valid-user

   # enable line below for only users from a specified group
   Require ldap-group cn=SVNUser,ou=Groups,dc=office,dc=lan
</Location>

- Save the file and restart apache from the Zentyal console or issuing the command:

Code: [Select]

sudo service apache2 restart
- You can how access the SVN from the web using the address:

http://<server name or address/svn/

or

https://<server name or address/svn/

I hope this guide will be useful to those attempting the same configuration. All the best guys.

[peterpugh]

http://doc.zentyal.org/en/appendix-c.html#advanced-service-customization

All the services and Zentyal rewrite the config files that you normally would expect.

in var/www that is the default site so you should locate the files in sub directory /svn

If its somewhere else create a directory alias so it links /svn to where ever the install is.

http://httpd.apache.org/docs/2.2/urlmapping.html

The top link needs to be read as you need to create or hook or stub for the directory alias.

I wish actually in the webadmin config of all modules there was a place where you can include script.

PS

In /etc/apache2 sites enabled have a look at the zentyal created ones the alias should be at the top of the site declarations.

[ajohan]

http://doc.zentyal.org/en/appendix-c.html#advanced-service-customization

All the services and Zentyal rewrite the config files that you normally would expect.

Hi peter

thanks for the share, initially i made changes to the sites-enabled/default file and found out that zentyal rewrites the file.

however, in my setup that i have tested and it seems the mods-enabled/dav_svn.conf is not overwritten. the url is set by the <location> tag at the top of the .conf file, which in the example i gave is /svn.

[peterpugh]

To be honest I havent got a clue what a site declaration will do in a module. Mods (Modules) such as rewrite, proxy and auth are additions to the apache engine to allow further functionality.

a2enmod [Module_Name] enables them.

a2ensite [Conf_Name] enables a site declaration in sites available and creates a symlink in sites enabled so they will run.

a2enmod is similar but for modules.

I wouldn't expect it to work, but hey you never know.