I am trying to configure access to subversion via Apache using the authz_svn_module module. Access for ldap users is fairly start forward but when i try to limit it to valid users in a certain group I get authorisation denied. See logs at the bottom of the page.
I have included, what I beleive to be, the similar ldapsearch query to the subversion.conf configuration below. However I keep getting a failure.
I do not know what the log is trying to tell me.
I am trying to limit access to users in the adm-group
Redhat 7.9 - Redhat IDM/FreeIPA
CentOS 6.10
ldapsearch -y /home/jdoe/.roapass -LLL -h myldap.abc.net -D "uid=read-only-acct,cn=users,cn=accounts,dc=abc,dc=net" -b cn=users,cn=accounts,dc=abc,dc=net uid=jdoe|grep "adm-group\|cn:\|displayName:\|uidNumber:\|uid\|gecos"
dn: uid=jdoe,cn=users,cn=accounts,dc=abc,dc=net
memberOf: cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net
displayName: John Doe
cn: John Doe
uidNumber: 2000nnnn
gecos: John Doe
uid: jdoe
Excerpt from my subversion.conf file
LoadModule dav_svn_module modules/mod_dav_svn.so
LoadModule authz_svn_module modules/mod_authz_svn.so
...
Require valid-user
Require lAuthLDAPBindPassword <mypasswd here>
Require AuthLDAPBindDN uid=read-only-acct,cn=users,cn=accounts,dc=abc,dc=net
AuthLDAPURL "ldaps://myldap.abc.net/CN=users,CN=accounts,DC=abc,DC=net?uid"
AuthLDAPGroupAttribute memberOf
Require ldap-group cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net
...
Log file entries
[debug] mod_authnz_ldap.c(432): [client 192.n.n.n] [11029] auth_ldap authenticate: using URL ldaps://myldap.abc.net/CN=users,CN=accounts,DC=abc,DC=net?uid
[debug] mod_authnz_ldap.c(516): [client 192.n.n.n] [11029] auth_ldap authenticate: accepting jdoe
[debug] mod_authnz_ldap.c(860): [client 192.n.n.n] [11029] auth_ldap authorise: require group: testing for group membership in "cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net"
[debug] mod_authnz_ldap.c(866): [client 192.n.n.n] [11029] auth_ldap authorise: require group: testing for memberOf: uid=jdoe,cn=users,cn=accounts,dc=abc,dc=net (cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net)
[debug] mod_authnz_ldap.c(883): [client 192.n.n.n] [11029] auth_ldap authorise: require group "cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net": authorisation failed [Comparison complete][Insufficient access]
[debug] mod_authnz_ldap.c(1023): [client 192.n.n.n] [11029] auth_ldap authorise: authorisation denied