Odtnhj

I have installed and configured a subversion in Linux7 and from the front end I am using svn tortoise. From server lever, I want to integrate my subversion with AD.

I have two repositories inside /u01/ciroot/subversion, like DEV_REPO and PROD_REPO.

Also in AD I have two groups; one is OBIEE_DEV and another is OBIEE_PROD. Now I want members of group OBIEE_DEV to access the repository DEV_REPO and members of group OBIEE_PROD
to access the repository DEV_REPO and PROD_REPO (both). So in my AD, under group OBIEE_DEV, I have user1 and user2 both there, but in the AD group OBIEE_PROD I only have user2.

These things are placed properly. But in /etc/httpd/conf.d/subversion.conf file how should I declare this? Below is my subversion.conf file where right now only one group entry is mentioned which is OBIEE_DEV, i want to add entry for group OBIEE_PROD too here. Please guide me how to achieve this.

<pre>
 <location /svn>
 DAV svn
 SVNParentPath /u01/ciroot/subversion
 AuthType Basic
 AuthBasicProvider ldap
 AuthName "Root Repo"
 AuthLDAPURL "ldap://ldap.server.com:389/DC=macgroup,DC=local?sAMAccountName?sub?(&(ObjectClass=*)(memberOf=CN=OBIEE_DEV,OU=OBIEE,OU=Security,OU=Groups,OU=Global Resources,DC=MACGROUP,DC=LOCAL))" STARTTLS

 AuthLDAPBindDN "CN=oidkerbt,OU=Service Accounts,OU=Users,OU=Global 
 Resources,DC=macgroup,DC=local"
 AuthLDAPBindPassword password_of_ldap_server
 Require valid-user
 </location>
</pre>

First, read the box titled "Do You Really Need Path-Based Access Control?" here: http://svnbook.red-bean.com/en/1.7/svn.serverconfig.pathbasedauthz.html

But if you still decide you want to do this, that link should help you set this up. But basically, create two location entries: one for each repository. You point each at the group at the AD group that grants that permission.

If you want people in the OBIEE_PROD group to have access to the DEV_REPO too, then just add the OBIEE_PROD group to your OBIEE_DEV group in AD.

This is an example, but I can't guarantee this will work exactly as-is:

<location /svn/DEV_REPO>
 DAV svn
 SVNParentPath /u01/ciroot/subversion
 AuthType Basic
 AuthBasicProvider ldap
 AuthName "Root Repo"
 AuthLDAPURL "ldap://ldap.server.com:389/DC=macgroup,DC=local?sAMAccountName?sub?(&(ObjectClass=*)(memberOf=CN=OBIEE_DEV,OU=OBIEE,OU=Security,OU=Groups,OU=Global Resources,DC=MACGROUP,DC=LOCAL))" STARTTLS

 AuthLDAPBindDN "CN=oidkerbt,OU=Service Accounts,OU=Users,OU=Global 
 Resources,DC=macgroup,DC=local"
 AuthLDAPBindPassword password_of_ldap_server
 Require valid-user
</location>
<location /svn/PROD_REPO>
 DAV svn
 SVNParentPath /u01/ciroot/subversion
 AuthType Basic
 AuthBasicProvider ldap
 AuthName "Root Repo"
 AuthLDAPURL "ldap://ldap.server.com:389/DC=macgroup,DC=local?sAMAccountName?sub?(&(ObjectClass=*)(memberOf=CN=OBIEE_PROD,OU=OBIEE,OU=Security,OU=Groups,OU=Global Resources,DC=MACGROUP,DC=LOCAL))" STARTTLS

 AuthLDAPBindDN "CN=oidkerbt,OU=Service Accounts,OU=Users,OU=Global 
 Resources,DC=macgroup,DC=local"
 AuthLDAPBindPassword password_of_ldap_server
 Require valid-user
</location>