title: SVNSERVE ldap groups
body: <p>I need to configure svnserve daemon to authenticate users using the ldap group. All my svn repositories are in a CentOS box. I performed the following steps:</p>
  
  <p>1- Install libraries:</p>
  
  <blockquote>
  <pre><code>yum install subversion cyrus-sasl cyrus-sasl-ldap cyrus-sasl-plain db4-utils
  </code></pre>
  </blockquote>
  
  <p>2- Edit the svnserve.conf inside of each repository to use sasl and to set the realm name as the ldap  group that can access to this repository.</p>
  
  <blockquote>
  <pre><code># Disable anonymous access to the repo
  anon-access = none
  # Let’s make sure that you are authenticated if you want to write in the repo itself
  auth-access = write
  realm = a_goup_dn
  # Tell Subversion to use SASL for the authentication mechanism
  use-sasl = true
  # Make sure that there is no encryption for the authentication mechanism
  min-encryption = 0
  </code></pre>
  </blockquote>
  
  <p>3- Edit the file /etc/sasl2/svn.conf to configure the svnserve sasl communication.</p>
  
  <blockquote>
  <pre><code>###################################################################
  # For CentOS /etc/sasl2/svn.conf
  # For other distro you may need to put the file here : /usr/lib/sasl2/svn.conf
  # For other distro the file may also be named subversion.conf instead of svn.conf
  # Symbolic link may be your friend here to figure out where does this file #need to be and it’s name.
  #
  # Password method, use the sasl authentication deamon.
  pwcheck_method: saslauthd
  #
  ## Auxiliary plugin, use ldap
  auxprop_plugin: ldap
  #
  ## Mechanism list, plain text only
  mech_list: PLAIN
  ldapdb_mech: PLAIN
  # EOF
  #########################################################
  </code></pre>
  </blockquote>
  
  <p>4- Edit the file /etc/saslauthd.conf to configure the sasl ldap communication. The most important here is that I am using the %r substitution in the ldap_group_dn field in order to force to the user to pertain to the correct ldap group defined in each svnserve.conf file. </p>
  
  <blockquote>
    #
  
  <pre><code>#/etc/saslauthd.conf
  #
  # Your AD server adress
  #ldap_servers: ldap://192.168.123.68:10389
  ldap_servers: ldap://192.168.123.122
  #
  # I love default domain name, I just want to put the username part for #my authentication #not the whole user@domain.local
  #ldap_default_domain: intech.com
  #
  # Where are the users located in the AD?  If you haven’t change the default tree of your AD it should be under the Users OU.
  ldap_search_base: dc=sample,dc=com
  #
  # You need a user account to be able to make the authentication in the Active Directory, I suggest you create a user just for that!
  ldap_bind_dn: cn=manager,dc=sample,dc=com
  
  #
  # Of course there is a password associated with this user, put it here :
  ldap_bind_pw: ldapuser123
  #
  # Misc options for LDAP to make it work with Microsoft AD.  Nothing to change here, move along…
  ldap_deref: never
  ldap_restart: yes
  ldap_scope: sub
  ldap_use_sasl: no
  ldap_start_tls: no
  ldap_version: 3
  ldap_auth_method: bind
  ldap_filter: sAMAccountName=%u
  ldap_password_attr: userPassword
  ldap_timeout: 10
  ldap_cache_ttl: 30
  ldap_cache_mem: 32768
  ldap_group_dn: %r
  dap_group_match_method: filter
  ldap_group_filter: (uniqueMember=%D)
  ldap_group_attr:  uniqueMember
  #EOF
  #########################################################
  </code></pre>
  </blockquote>
  
  <p>This seems to work but I wonder if there is any negative consequence for using the realm name attribute  to communicate the ldap group.</p>
  
  <p>Thanks in advance</p>