seigafuse.com

Overview

ADISS is a simple tool to automated the generation of Subversion AuthzSVNAccessFiles. The simple web interface allows the administrator to define the repostirory paths, the full path to the AuthzSVNAccessFile and the LDAP filter for the Active Directory group that will be used to control access. The script adiss_batch.php (run via a cron job or scheduled task you create at the interval you define)

Technology

Apache, mySQL, PHP. Written and tested on Linux by should work on other operating systems. Uses PHP_LDAP and PHP_MYSQL

Licensing

Free to use, modify and distribute under the terms of the GNU GPL

Theory of Operation

The Active Directory groups you enter should already be defined in AD as adiss will seek to query group membership as you add them. If you create mail enabled groups in AD, you may define the owner of the groups as the repository owner and that person will be able to add/remeove members to the group using Outlook. In this fashion you have effectively delegated admin rights for each repository without granting anyone any elevated rights on your Subversion server. More details on how to use ADISS can be found in the README file. This program also assumes you have already created your Subversion repository. The procedures to create your repository can be found in the Subversion documentation, procedures that are known to work with ADISS are included here for reference.

Creating new repositories

• Login to the Subversion server using an account suitably privileged (account has access to create directories and modify Apache configuration files)
• Select and navigate to a suitable location to store the repository (/home, /var, or other location)
• Execute the command:

svnadmin create –-fs-type fsfs path-to-repository
Example – svnadmin create –-fs-type fsfs /home/testrepo

Note: A repository is created with a BerkleyDB back-end by default; thus the fs-type switch must be specified to achieve the correct type of repository

• Next you will need to enable this repository for access via Apache’s WEBDAV. To do this perform the following tasks:
• Navigate to /etc/httpd/conf.d
• Create an Apache configuration file such as the one listed below (items in bold may need to be adjusted to your environment):

• Next, access adiss via the configured url; http:///adiss/; use your DOMAIN username and password.

Screenshots can be found here

Downloads

Download avaialble from the Sourceforge Project Page

Installation

Obtain and extract the tarball to a location under your web server’s root directory, for example:

cd /var/www/html tar -zxvf adiss-0.90.tgz

Rename the directory if so desired:

mv adiss-x.xX adiss

Set permissions on the directory so that the account your web server runs as has permissions to the files:

chown -R apache:apache adiss

Create the database:

cd adiss mysql create database adiss; grant SELECT, INSERT, UPDATE, DELETE on adiss.* to adiss@localhost identified by ‘password’; flush privileges; quit mysql adiss < create_tables.sql (the file is misnamed as create_tables.sql.sql in the intital release, just rename it or use the correct file name)
Modify the config.inc.php file to match your environment. (the instructions in the INSTALL.txt file have this as config.in.php – it should be config.inc.php)

Restart Apache after adding the above (service httpd restart or other server specific command).

Launch a browser and visit the URL http://yourhost/adiss

When you define a repository and all relevant data adiss will create the AuthzSVNAccessFile at the location specified after getting the list of members via LDAP query to AD. To enable the interface to detect changes to AD groups and update the AuthzSVNAccessFile you will need to schedule adiss_batch.php to run at some interval. The updates are intelligent in that adiss track the USNChanged AD attribute in the database and will skip updating the AuthzSVNAccessFile for groups that have not changed. The interface also provides a mechanism (via the additions field) to define additional users to be granted access (either read-only or read-write, whereas all group members are granted read-write access).

Note: Some users have reported issues with ADISS until an Apache alias directive was added, if you are having problems you may want to try adding the alias directive to the apache configuration file.

Feedback and Support

If you have any feedback on how ADISS works for you, a problem to report or a suggestion to improve ADISS just leave a comment here.