HowTo to handle SVN repositories creation and access control with Redmine¶
This setup is not required if you just need to browse your repositories and changesets from Redmine.
As of version 0.5.0, Redmine is able to handle Subversion repositories creation and access control.
Once you’ve done this extra setup, Redmine will create the repository for each of your projects. Users will be allowed to access the repositories using ssh+svn, according to their permissions defined in Redmine :
- for public projects : read access to the repository for any user, write access for project members only,
- for private projects : read/write access allowed to project members only.
User authentication is done with the same login/password as for Redmine access.
You need Redmine 0.5.0 or higher, running with MySQL1.
Your SVN repositories must be hosted on a *nix system. They don’t have to be on the same host you installed Redmine on.
Is required on your SVN host :
- pam_mysql 0.7pre2 or higher, compiled with SHA1 support2
- perl with SOAP::Lite package
Scripts used in this HowTo can be found in the /extra/svn directory of Redmine.
The SVN host must be able to access both the redMine database and HTTP server(s). In many cases, they will all be located on the same host.
Preparing the Redmine database¶
Some views need to be added to the Redmine database. These views are used to authenticate users and retrieve their permissions.
1. Create the different views in your redMine database :
mysql --user=redmine_user redmine_database -p < db_views.sql
2. Grant privileges :
mysql --user=root mysql> create user redmine_nss@localhost identified by 'averylongpassword'; mysql> grant SELECT on redmine.nss_groups to redmine_nss@localhost; Query OK, 0 rows affected (0.03 sec) mysql> grant SELECT on redmine.nss_users to redmine_nss@localhost; Query OK, 0 rows affected (0.00 sec) mysql> grant SELECT on redmine.nss_grouplist to redmine_nss@localhost; Query OK, 0 rows affected (0.00 sec) create user redmine_pam@localhost identified by 'averylongpassword'; grant SELECT on redmine.ssh_users to redmine_pam@localhost;
Configuring nss-mysql on your SVN server¶
3. Create the /etc/nss-mysql.conf as follows:
conf.version = 2; users.host = inet:localhost:3306; users.database = redmine; users.db_user = redmine_nss; users.db_password = averygoodpassword; users.backup_database = nss_mysql_backup; users.table = nss_users; users.user_column = nss_users.username; users.userid_column = nss_users.uid; users.uid_column = nss_users.uid; users.gid_column = 100; users.realname_column = nss_users.realname; users.homedir_column = "/false/path"; users.shell_column = "/usr/local/bin/svnserve.wrapper"; groups.group_info_table = nss_groups; groups.group_name_column = nss_groups.name; groups.groupid_column = nss_groups.gid; groups.gid_column = nss_groups.gid; groups.password_column = "x"; groups.members_table = nss_grouplist; groups.member_userid_column = nss_grouplist.username; groups.member_groupid_column = nss_grouplist.gid;
4. Install the svnserve wrapper
sudo install svnserve.wrapper /usr/local/bin
5. Change /etc/nsswitch.conf
Add “mysql” to the two lines passwd and group like that :
passwd: compat mysql group: compat mysql
6. Test that all this stuff works :
You must have users in some project to verify.
% getent passwd [...] user1:x:5002:100:user1 user1:/false/path:/usr/local/bin/svnserve.wrapper user2:x:5003:100:user2 user2:/false/path:/usr/local/bin/svnserve.wrapper % getent group [...] projet redmine 1:x:5001: projet redmine 2:x:5002:
Authorize ssh pam to use mysql¶
7. Add the line :
auth sufficient pam_mysql.so user=redmine_pam passwd=averylongpassword host=localhost db=redmine table=ssh_users usercolumn=username passwdcolumn=password crypt=4
auth required pam_unix.so nullok_secure
8. Test this against an existing Redmine user
Try to connect to the SVN host using your Redmine username and password:
Automating repository creation¶
Repository creation can be automated by running periodically the reposman.pl script.
It takes 2 arguments :
- svn-dir : path to the directory where your svn repositories are located
- redmine-host : host name of your Redmine install
$ sudo reposman --svn-dir=/var/svn --redmine-host=redmine.mydomain.foo repository /var/svn/project2 created repository /var/svn/project1 created mode change on /var/svn/project3
Projects are retrieved from Redmine using a SOAP web service. This web service is disabled by default in Redmine.
To enable it, go to “Administration -> Settings” and check “Enable WS for repository management”.
2 You must use "./configure --with-openssl" in order to add SHA1 support to pam_mysql
1 Other databases can’t be used because of various problems: no pam module, no sha1 handling, ...