How to change user authentication

micdal · Post by **micdal** » Mon Jun 03, 2013 2:01 pm

Hi,

During my tests with Agent SVN I used a dummy user to access the SVN repository (via http).
Now I like to switch to the "right" user (with my own credentials), but I didn't find a way to do that.

So, how to change the user name (and password) which Agent SVN uses to access the repository?

Thanks in advance
Michael

Post by **jussij** » Mon Jun 03, 2013 3:45 pm

Agent SVN uses the user credentials of the IDE that is using the Agent SVN plug-in.

So for example, if you are logged in to your PC with your user ID then when you start the IDE it will be using that ID.

Some IDEs have an option to change the user ID.

As an example of this here is how you set the User ID in Power Builder:

So if you change the user ID inside the IDE then that ID will be passed to Agent SVN and it will use that ID to try to connect to the SVN server.

Post by **jussij** » Tue Jun 04, 2013 3:33 am

One other thing to remember is SVN will cache the logon details.

Below is an extract from this page describing how this works: http://www.yolinux.com/TUTORIALS/Subversion.html

Subversion Security Tips:

One should be aware of a possible Subversion client security hole. The Subversion client authentication will cache your login and password in your home directory in non-encrypted clear text. It will have file system security so others can not read the file however, it still is visible by root or by a root user of the file server if one is used for home directories.

Here are three solutions to reduce this potential security vulnerability:
1.Don't allow Subversion to cache the password: svn commit -F file.txt --no-auth-cache
This will request a username and password but will not store it.

2.Set the Subversion configuration file on server to not cache:

[auth]
store-auth-creds = no

3.Delete cached files when you logout. Reduces risk but does not eliminate it. This uses the bash shell logout script to perform a clean-up of the authentication files. File: ~/.bash_logout

So if you are having trouble with the logon you might have to clear that cache.

For more details on how to do this see these links:

http://subversion.1072662.n5.nabble.com ... 46972.html
http://www.svnforum.org/threads/31174-S ... entication

Cheers Jussi

micdal · Post by **micdal** » Wed Jun 05, 2013 12:10 pm

Thanks for the respond.

The IDE I'm using is called "Final Builder". It's a tool for writing build automation processes.
The user name is not configurable via the IDE; it's only selectable which Source Control Provider should be used.

I have a sneaking suspicion, that there is some other process which changes the user name intendedly. But I couldn't image which process this could be.

Clearing the cached user credentials, is a work around at the moment.

So, thanks again for your support.

micdal · Post by **micdal** » Wed Jun 05, 2013 2:35 pm

In the meantime I found the "wrongdoer":

The build process I run inside the IDE itself performs a SVN access (checkout of some files). For that, I used a different SVN account and have overlooked the option box "don't cache authentication information locally (--no-auth-cache)".
After enabling this, my SVN credentials are not changed any more!

Post by **jussij** » Wed Jun 05, 2013 11:32 pm

The user name is not configurable via the IDE

FYI. When no user ID is provided Agent SVN defaults to the Windows user ID.

Glad to read you found the issue and the --no-auth-cache option.

The way SVN so easily and so quietly caches the logon user details can be a little painful.

Cheers Jussi

kurasov1965K · Post by **kurasov1965K** » Tue Sep 26, 2017 12:40 pm

Hi,

Just wonder if its possible to use LDAP or PAM for user/group authentication?

Thanks.

Post by **jussij** » Tue Sep 26, 2017 1:11 pm

Just wonder if its possible to use LDAP or PAM for user/group authentication?

The first think to understand is Agent SVN is a client side tool and it just uses the Subversion client to talk to the Subversion server.

By default it uses the stock standard Subversion client, but it can also be easily configure to use any other client, provided that client is 100% compatible with the standard Subversion client (i.e. has the same command line inputs).

With that in mind, the type of authentication possible will depend entirely on the Subversion server setup and the corresponding Subversion client that talks to that server.

So if you can setup such a LDAP or PAM Subversion environment then it should also work with Agent SVN.

A quick google search seems to suggest it is be possible to configure the Subversion for at least LDAP, but don't quote me on that

.

Cheers Jussi

Post by **jussij** » Sat Sep 30, 2017 2:23 am

For those running an Apache HTTP Subversion server, LDAP support possible using the mod_authnz_ldap module.

More details on that module can be found here: http://httpd.apache.org/docs/current/mo ... _ldap.html

Other authorization options are listed here: http://httpd.apache.org/docs/current/howto/auth.html

Cheers Jussi