Apache LDAP 身份验证 Redmine

Question

我在 Apache 服务器 (RHEL 6.1) 上设置了 Redmine。我还有一个在 /var/svn 运行的 Subversion 服务器。我为我的 subversion 配置了正确的 LDAP 身份验证，因此当有人访问 subversion 存储库时（通过命令行：svn checkout/update/commit，或通过 http://myserver.com/svn/project)，它会提示输入用于对 LDAP 服务器进行身份验证的用户名和密码。

但是：在 Redmine 中浏览项目页面时，我看到出现“存储库”选项卡（并且它链接到正确的地址： http://myserver.com/svn/project）。但是当我导航到此选项卡时，它显示“404 在存储库中找不到条目或修订”。我有一种感觉，404 是由于 Redmine 无法针对 LDAP 进行身份验证而产生的。所以我的问题是如何允许 Redmine 进入该目录，但其他人都需要通过 LDAP 进行身份验证？

Answer 1

我已经弄清楚了我的问题并提出了一个相当简单的解决方案。我的假设是正确的 - 因为 Redmine 不知道如何处理 LDAP 请求，所以它抛出了 404。

下面是允许 Redmine（或在同一服务器上运行的任何服务）通过身份验证过程的正确 Apache 配置：

<Location /svn>
    # The following two lines allow for any request made by this machine through
    #  We do this to allow Redmine to have access without needing to authenticate against LDAP
    # NOTE: The IP address MUST be the one given by DHCP - the loop-back (127.0.0.1) will NOT WORK
    Order allow,deny
    Allow from ACTUAL_IP_ADDRESS (example: 123.45.67.100)


    # The following authenticates against LDAP for any request NOT made by the same server
    # This includes anyone attempting to access:
    #       http://myserver.com/svn/*
    #  either via web-browser, or svn command
    #
    # Tell apache this is a subversion repository
    DAV svn
    # Where the subversion repository list exists on the file system
    SVNParentPath "/var/svn"
    # What kind of authentication 
    AuthType Basic
    AuthName "Restricted Subversion Content"
    AuthBasicProvider ldap
    AuthLDAPBindDN "YOUR_BIND_DN"
    AuthLDAPBindPassword "YOUR_BIND_PASSWORD"
    AuthLDAPURL "YOUR_LDAP_URL"
    # Require a valid-LDAP user (if not from the allowed IP address)
    Require valid-user

    # This line (very important) tells Apache that the request needs to follow AT LEAST
    # one of the following:
    #       - The request is from the IP address listed above
    #       - All others MUST authenticate using LDaP
    # If we wanted BOTH to be required (not in our case), we would use "Satisfy All"
    Satisfy Any

我希望这可以帮助其他正在寻找类似解决方案的人！