How do I set up access control in SVN?
Solution 1
In your svn\repos\YourRepo\conf folder you will find two files, authz and passwd. These are the two you need to adjust.
In the passwd file you need to add some usernames and passwords. I assume you have already done this since you have people using it:
[users]
User1=password1
User2=password2
Then you want to assign permissions accordingly with the authz file:
Create the conceptual groups you want, and add people to it:
[groups]
allaccess = user1
someaccess = user2
Then choose what access they have from both the permissions and project level.
So let's give our "all access" guys all access from the root:
[/]
@allaccess = rw
But only give our "some access" guys read-only access to some lower level project:
[/someproject]
@someaccess = r
You will also find some simple documentation in the authz and passwd files.
Solution 2
@Stephen Bailey
To complete your answer, you can also delegate the user rights to the project manager, through a plain text file in your repository.
To do that, you set up your SVN database with a default authz
file containing the following:
###########################################################################
# The content of this file always precedes the content of the
# $REPOS/admin/acl_descriptions.txt file.
# It describes the immutable permissions on main folders.
###########################################################################
[groups]
svnadmins = xxx,yyy,....
[/]
@svnadmins = rw
* = r
[/admin]
@svnadmins = rw
@projadmins = r
* =
[/admin/acl_descriptions.txt]
@projadmins = rw
This default authz
file authorizes the SVN administrators to modify a visible plain text file within your SVN repository, called '/admin/acl_descriptions.txt', in which the SVN administrators or project managers will modify and register the users.
Then you set up a pre-commit hook which will detect if the revision is composed of that file (and only that file).
If it is, this hook's script will validate the content of your plain text file and check if each line is compliant with the SVN syntax.
Then a post-commit hook will update the \conf\authz
file with the concatenation of:
- the TEMPLATE
authz
file presented above - the plain text file
/admin/acl_descriptions.txt
The first iteration is done by the SVN administrator, who adds:
[groups]
projadmins = zzzz
He commits his modification, and that updates the authz
file.
Then the project manager 'zzzz' can add, remove or declare any group of users and any users he wants.
He commits the file and the authz
file is updated.
That way, the SVN administrator does not have to individually manage any and all users for all SVN repositories.
Solution 3
One gotcha which caught me out:
[repos:/path/to/dir/] # this won't work
but
[repos:/path/to/dir] # this is right
You need to not include a trailing slash on the directory, or you'll see 403 for the OPTIONS request.
Solution 4
You can use svn+ssh:, and then it's based on access control to the repository at the given location.
This is how I host a project group repository at my uni, where I can't set up anything else. Just having a directory that the group owns, and running svn-admin (or whatever it was) in there means that I didn't need to do any configuration.
Solution 5
Although I would suggest the Apache approach is better, SVN Serve works fine and is pretty straightforward.
Assuming your repository is called "my_repo", and it is stored in C:\svn_repos:
Create a file called "passwd" in "C:\svn_repos\my_repo\conf". This file should look like:
[Users] username = password john = johns_password steve = steves_password
In C:\svn_repos\my_repo\conf\svnserve.conf set:
[general] password-db = passwd auth-access=read auth-access=write
This will force users to log in to read or write to this repository.
Follow these steps for each repository, only including the appropriate users in the passwd
file for each repository.
Related videos on Youtube
Niju Mt
Updated on April 30, 2020Comments
-
Niju Mt about 4 years
I have set up a repository using SVN and uploaded projects. There are multiple users working on these projects. But, not everyone requires access to all projects. I want to set up user permissions for each project.
How can I achieve this?
-
ErichBSchulz over 11 yearsrelevant manual page is: svnbook.red-bean.com/en/1.7/…
-
AVA about 9 yearsCaution : Passwords are stored in plain-text in SVN conf file!
-
ALex_hha over 8 yearsNote: it wont work if you access repository direct via ssh (without svnserve)
-
user1040323 about 7 yearsThis is an appalling answer. This ssh method is poorly documented and seems to only work for Linux.
-
Chuck Wolber about 7 yearsSimply not true. One only needs to run an SSH daemon on their windows server and svn+ssh works for Windows exactly the same as it does for Linux. There are many tutorials that explain how to run SSH on a windows machine.
-
Matthew Schinckel about 7 yearsAlso, dear @user1040323, there are other non-Linux platforms other than Windows: pretty sure the machine I was on wasn't Linux, but some BSD variant.
-
maoanz almost 7 yearsWhen I give for example one folder under a repository to user, user can only access this folder with direct link. Is it possible for user to add repository and only folders assigned to him are displayed to him? Thanks for the reply .
-
Wolfeh over 6 yearsgroups are called with
@groupname
this one bit me when defining rules, it's perfect in your examples, just pointing out.