I am trying to configure access to subversion via Apache using the authz_svn_module module. Access for ldap users is fairly start forward but when i try to limit it to valid users in a certain group I get authorisation denied. See logs at the bottom of the page.

I have included, what I beleive to be, the similar ldapsearch query to the subversion.conf configuration below. However I keep getting a failure.

I do not know what the log is trying to tell me.

I am trying to limit access to users in the adm-group

Redhat 7.9 - Redhat IDM/FreeIPA

CentOS 6.10

• Apache 2.2
• mod_dav_svn-1.7.4-0.1.el6.rfx.x86_64
• subversion-1.7.4-0.1.el6.rfx.x86_64

ldapsearch -y /home/jdoe/.roapass -LLL -h myldap.abc.net -D "uid=read-only-acct,cn=users,cn=accounts,dc=abc,dc=net" -b cn=users,cn=accounts,dc=abc,dc=net uid=jdoe|grep "adm-group\|cn:\|displayName:\|uidNumber:\|uid\|gecos"

dn: uid=jdoe,cn=users,cn=accounts,dc=abc,dc=net
memberOf: cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net
displayName: John Doe
cn: John Doe
uidNumber: 2000nnnn
gecos: John Doe
uid: jdoe

Excerpt from my subversion.conf file

LoadModule dav_svn_module     modules/mod_dav_svn.so
LoadModule authz_svn_module   modules/mod_authz_svn.so

...

Require valid-user
Require lAuthLDAPBindPassword <mypasswd here>
Require AuthLDAPBindDN uid=read-only-acct,cn=users,cn=accounts,dc=abc,dc=net

AuthLDAPURL "ldaps://myldap.abc.net/CN=users,CN=accounts,DC=abc,DC=net?uid"
AuthLDAPGroupAttribute     memberOf
Require ldap-group cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net

...

Log file entries

 [debug] mod_authnz_ldap.c(432): [client 192.n.n.n] [11029] auth_ldap authenticate: using URL ldaps://myldap.abc.net/CN=users,CN=accounts,DC=abc,DC=net?uid

 [debug] mod_authnz_ldap.c(516): [client 192.n.n.n] [11029] auth_ldap authenticate: accepting jdoe

 [debug] mod_authnz_ldap.c(860): [client 192.n.n.n] [11029] auth_ldap authorise: require group: testing for group membership in "cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net"

 [debug] mod_authnz_ldap.c(866): [client 192.n.n.n] [11029] auth_ldap authorise: require group: testing for memberOf: uid=jdoe,cn=users,cn=accounts,dc=abc,dc=net (cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net)

 [debug] mod_authnz_ldap.c(883): [client 192.n.n.n] [11029] auth_ldap authorise: require group "cn=adm-group,cn=groups,cn=accounts,dc=abc,dc=net": authorisation failed [Comparison complete][Insufficient access]

 [debug] mod_authnz_ldap.c(1023): [client 192.n.n.n] [11029] auth_ldap authorise: authorisation denied