Question

I have Redmine setup on an Apache server (RHEL 6.1). I also have a subversion server running at /var/svn. I have the proper LDAP authentication for my subversion configured, so when someone accesses the subversion repository (either via command line: svn checkout/update/commit, or through http://myserver.com/svn/project), it prompts for a username and password that authenticates against the LDAP server.

However: When browsing the project’s page in Redmine, I see the “Repository” tab appear (and it links to the proper address: http://myserver.com/svn/project). But when I navigate to this tab, it displays “404 The entry or revision was not found in the repository”. I have a feeling that the 404 is coming from Redmine not being able to authenticate against LDAP. So my question is how to allow Redmine into that directory, but everyone else needs to be authenticated against LDAP?

Answer 1

I have figured out my problem and came up with a fairly simple solution. My assumption was correct – because Redmine didn’t know how to handle the LDAP request, it threw a 404.

Below is the proper Apache configuration to allow Redmine (or any service running on the same server) through the authentication process:

<Location /svn>
    # The following two lines allow for any request made by this machine through
    #  We do this to allow Redmine to have access without needing to authenticate against LDAP
    # NOTE: The IP address MUST be the one given by DHCP - the loop-back (127.0.0.1) will NOT WORK
    Order allow,deny
    Allow from ACTUAL_IP_ADDRESS (example: 123.45.67.100)


    # The following authenticates against LDAP for any request NOT made by the same server
    # This includes anyone attempting to access:
    #       http://myserver.com/svn/*
    #  either via web-browser, or svn command
    #
    # Tell apache this is a subversion repository
    DAV svn
    # Where the subversion repository list exists on the file system
    SVNParentPath "/var/svn"
    # What kind of authentication 
    AuthType Basic
    AuthName "Restricted Subversion Content"
    AuthBasicProvider ldap
    AuthLDAPBindDN "YOUR_BIND_DN"
    AuthLDAPBindPassword "YOUR_BIND_PASSWORD"
    AuthLDAPURL "YOUR_LDAP_URL"
    # Require a valid-LDAP user (if not from the allowed IP address)
    Require valid-user

    # This line (very important) tells Apache that the request needs to follow AT LEAST
    # one of the following:
    #       - The request is from the IP address listed above
    #       - All others MUST authenticate using LDaP
    # If we wanted BOTH to be required (not in our case), we would use "Satisfy All"
    Satisfy Any

I hope this helps someone else looking for a similar solution!