Re: [Trac] Trac not following SVN access control permissions after Apache upgrade

[Mary Loftis]

Yes, I understand the admin group has r/w to all repos unless I 
specifically set the admin group to no access for a specific repo.

By removing my id from the admin group, I was able to also test the other 
group's permissions.

Thanks for the validation.

On Wednesday, September 28, 2016 at 4:31:52 AM UTC-4, Cooke, Mark wrote:

> Hi Mary, 
>
> > -Original Message- 
> > From: trac-...@googlegroups.com  [mailto:
> trac-...@googlegroups.com ] On 
> > Behalf Of Mary Loftis 
> > 
> > I set the authz_module_name = Beth_test in the trac.ini but it had no 
> affect. 
> > I also removed the loading of mod_access_compat and switched to using 
> the 
> > Require statements as is preferred with Apache 2.4.  It is sto;; letting 
> me 
> > browse the svn repo even though the authz_file permissions do not list 
> my id 
> > for that repo. 
> > 
> > The svn access file contains the following. My id is utcaus\leftism. I 
> am 
> > only in the admin group which has r/w access to /. I am not in the other 
> > groups which have access to the repos defined under slash. 
> > 
> > 
> > [groups] 
> > admin = utcaus\loftism, utcaus\vasquer-a, utcaus\g0044320 
> > # 
> > SVNtestteam = utcaus\haugsch, utcaus\welcher, utcaus\vasquer-a, 
> utcaus\g0044320 
> > # 
> > Bethtestteam = utcaus\welcher, utcaus\vasquer-a, utcaus\g0044320 
> > # 
> > [/] 
> > @admin = rw 
> > # Allow developers complete access to their project repos 
> > # 
> > [SVN_test:/] 
> > @SVNtestteam = rw 
> > # 
> > [Beth_test:/] 
> > @Bethtestteam = rw 
>
> Your authz file is not doing what you think it is. 
>
> [/] applies to the root of all repos and remains in force unless you 
> override. 
>
> To stop `@admin` from `SVN_test` you should use something like: 
>
> [SVN_test:/] 
> @admin = 
> @SVNtestteam = rw 
>
> Check out the subversion book:- 
>
>
> http://svnbook.red-bean.com/nightly/en/svn.serverconfig.pathbasedauthz.html#svn.serverconfig.pathbasedauthz.getting-started
>  
>
> Regards, 
>
> ~ Mark C 
>
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

[Trac] Re: Trac not following SVN access control permissions after Apache upgrade

[Mary Loftis]

Mystery solved, I think. Since my id is in the admin group which has r/w 
access to the top-level slash directory, it is giving me access to all 
repos. If I remove my name from the admin group, then the access controls 
defined for each repo's group are being followed.
 

Not in admin group, in Bethtestteam group => Have access to Beth_test 

Not in admin group, not in Bethtestteam group => No access to Beth_test

In admin group => Have access to Beth_test regardless of contents of 
Bethtestteam.

Thanks to all for their suggestions. 
 
On Tuesday, August 23, 2016 at 11:59:05 AM UTC-4, Mary Loftis wrote:

> Platform: Windows Server 2008 R2 
> Apache 2.2.23 (win32)/SSL 1.0.0j upgrading to Apache 2.4.23 (win32)/SSL 
> 1.0.2h 
> CollabNet Subversion Client SVNServe 1.7.8
> Trac 1.0.9 (win32) 
> Python 2.7.1
>  
>
> On a Windows server, I had Subversion and Trac interacting nicely when 
> running Apache 2.2.23, Subversion 1.7.8 with Trac 1.0.9 and the mod_python 
> module. Access to Trac projects was permitted based on access control 
> groups defined in the subversion access control file. The setting of the 
> AuthzSVNAccessFile variable in the httpd.conf file pointed to the 
> subversion access control file, e:/etc/.svnaccess. If the user had access 
> to a subversion repo, then they had access to the associated Trac project, 
> otherwise access was denied.
>  
> The httpd.conf file contained the following:
>  
> 
>   SVNParentPath e:/svn_repository
>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>   SetHandler mod_python
>   PythonHandler trac.web.modpython_frontend
>   PythonOption TracEnvParentDir e:\trac
>   PythonOption TracUriRoot /trac
>   AuthType SSPI
>   SSPIAuth On
>   SSPIOfferSSPI Off
>   SSPIAuthoritative On
>   SSPIDomain 
>   SSPIOmitDomain Off
>   SSPIUsernameCase lower
>   SSPIPerRequestAuth On
>   SSPIOfferBasic On
>   AuthName "UTAS TRAC Login (Use domain\userid format)"
>   Require valid-user
> 
>  
>  
> I then had to upgrade Apache/SSL to 2.4.23, 1.0.2h. With this upgrade, 
> mod_python was obsoleted so I had to switch to use mod_wsgi load module. I 
> added in the mod_wsgi.so load module and modified the config file to remove 
> the Python-related settings (keeping the AuthzSVNAccessFile setting), and 
> adding in mod_wsgi info.
>  
> After the Apache upgrade, the httpd.conf file contained:
>  
> 
>   SVNParentPath e:/svn_repository
>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>   AuthType SSPI
>   SSPIAuth On
>   SSPIOfferSSPI Off
>   SSPIAuthoritative On
>   SSPIDomain 
>   SSPIOmitDomain Off
>   SSPIUsernameCase lower
>   SSPIPerRequestAuth On
>   SSPIOfferBasic On
>   AuthName "UTAS TRAC Login (Use domain\userid format)"
>   Require valid-user
> 
>  
> WSGIScriptAlias /trac e:/trac/trac.wsgi
>  
> 
>WSGIApplicationGroup %{GLOBAL}
>Order deny,allow
>Allow from all
> 
>  
>  
>
>  
> The e:/trac.wsgi has the following in it:
>  
> import os
> import trac.web.main
> import site
>  
> site.addsitedir('e:\Python\Lib\site-packages')
>  
> os.environ['PYTHON_EGG_CACHE'] = r'c:\Trac-Python-Egg-Cache'
>  
> def application(environ, start_response):
>   environ['trac.env_parent_dir'] = r'e:\trac' 
>   return trac.web.main.dispatch_request(environ, start_response)
>  
>  
> The trac.ini file (for Beth_test project) has these critical sections, 
> same as before the Apache upgrade:
>  
>  [components]
> tracopt.versioncontrol.svn.* = enabled
> tracstats.* = enabled
>  
> [repositories]
> Beth_test.dir = e:\svn_repository\Beth_test
> Beth_test.description = This is the ‘Beth_test’ project repository on the 
> Test svn server.
> Beth_test.type = svn
> Beth_test.url = https:///svn/Beth_test
> Beth_test.hidden = true
> tsvn = tsvn: Interact with TortoiseSvn
>  
> [trac]
> authz_file = E:\etc\.svnaccess
> permission_policies = AuthzSourcePolicy, DefaultPermissionPolicy, 
> LegacyAttachmentPolicy
> permission_store = DefaultPermissionStore
> repository_dir = e:\svn_repository\Beth_test
> repository_type = svn
> …plus a bunch of other settings
>  
>  
>  
>
> My directory structure on the server is:
>
>  
>
> E:\svn_repository\
>
>Beth_test 
>
>SVN_test 
>
>  
>
> E:\trac\ 
>
>Beth_test 
>
>SVN_test
>
>  
>
> When I bring up the Trac url after entering my active directory 
> credentials, I see the 2 Trac projects listed. However when I click on a 
> project, it gives me access to it even though I have not added my id to the 
> access control group associated with the subversion Beth_test repo. With 
> Tor

[Trac] Re: Trac not following SVN access control permissions after Apache upgrade

[Mary Loftis]

In looking at the Apache error log file, it shows I am granted access to 
the svn repo when I use TortoiseSVN to browse the repo. I should NOT be 
allowed access since the id, utcaus\leftism, is not in the Bethtestteam 
group which is allowed access to Beth_test repo. (My id is in the admin 
group which has r/w to the / area.

E:/etc/.svnaccess:
[groups]
admin = utcaus\loftism, utcaus\vasquer-a, utcaus\g0044320
#
SVNtestteam = utcaus\haugsch, utcaus\welcher, utcaus\vasquer-a, utcaus\
g0044320
#
Bethtestteam = utcaus\welcher, utcaus\vasquer-a, utcaus\g0044320
#
[/]
@admin = rw
#
[SVN_test:/]
@SVNtestteam = rw
#
[Beth_test:/]
@Bethtestteam = rw



Error log file shows it granted access (which it should not):

[Tue Sep 27 13:23:12.939577 2016] [authz_core:debug] [pid 7148:tid 2612] 
mod_authz_core.c(806): [client 153.4.249.122:60169] AH01626: authorization 
result of Require valid-user : denied (no authenticated user yet)
[Tue Sep 27 13:23:12.939577 2016] [authz_core:debug] [pid 7148:tid 2612] 
mod_authz_core.c(806): [client 153.4.249.122:60169] AH01626: authorization 
result of : denied (no authenticated user yet)
[Tue Sep 27 13:23:12.939577 2016] [authnz_sspi:debug] [pid 7148:tid 2612] 
mod_authnz_sspi_authentication.c(439): [client 153.4.249.122:60169] 
SSPI1: Entering authenticate_sspi_user()
[Tue Sep 27 13:23:12.955177 2016] [authnz_sspi:debug] [pid 7148:tid 2612] 
mod_authnz_sspi_authentication.c(544): [client 153.4.249.122:60169] 
SSPI9: Authenticated user: utcaus\\loftism
[Tue Sep 27 13:23:12.955177 2016] [authz_svn:debug] [pid 7148:tid 2612] 
mod_authz_svn.c(195): [client 153.4.249.122:60169] *Path to authz file is 
E:/etc/.*
*svnaccess*[Tue Sep 27 13:23:12.955177 2016] [authz_svn:info] [pid 7148:tid 
2612] [client 153.4.249.122:60169] *Access granted: 'utcaus\\loftism' 
OPTIONS Beth_test:/*



On Tuesday, September 27, 2016 at 12:17:42 PM UTC-4, Mary Loftis wrote:

> I just tried accessing svn through TortoiseSVN and it is letting me access 
> the repo too. I shouldn't be allowed access to it. So I don't think it is 
> necessarily a trac problem but an Apache config problem. I'll have to do 
> some more investigation to figure out why it is letting me into the svn 
> repo. I thought I had been properly blocked by TortoiseSVN, but maybe I 
> confused my prod Apache server with my test (upgraded) Apache server. Back 
> to the drawing board.
>
> On Tuesday, August 23, 2016 at 11:59:05 AM UTC-4, Mary Loftis wrote:
>>
>> Platform: Windows Server 2008 R2 
>> Apache 2.2.23 (win32)/SSL 1.0.0j upgrading to Apache 2.4.23 (win32)/SSL 
>> 1.0.2h 
>> CollabNet Subversion Client SVNServe 1.7.8
>> Trac 1.0.9 (win32) 
>> Python 2.7.1
>>
>> On a Windows server, I had Subversion and Trac interacting nicely when 
>> running Apache 2.2.23, Subversion 1.7.8 with Trac 1.0.9 and the mod_python 
>> module. Access to Trac projects was permitted based on access control 
>> groups defined in the subversion access control file. The setting of the 
>> AuthzSVNAccessFile variable in the httpd.conf file pointed to the 
>> subversion access control file, e:/etc/.svnaccess. If the user had access 
>> to a subversion repo, then they had access to the associated Trac project, 
>> otherwise access was denied.
>>
>> The httpd.conf file contained the following:
>>
>> 
>>   SVNParentPath e:/svn_repository
>>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>>   SetHandler mod_python
>>   PythonHandler trac.web.modpython_frontend
>>   PythonOption TracEnvParentDir e:\trac
>>   PythonOption TracUriRoot /trac
>>   AuthType SSPI
>>   SSPIAuth On
>>   SSPIOfferSSPI Off
>>   SSPIAuthoritative On
>>   SSPIDomain 
>>   SSPIOmitDomain Off
>>   SSPIUsernameCase lower
>>   SSPIPerRequestAuth On
>>   SSPIOfferBasic On
>>   AuthName "UTAS TRAC Login (Use domain\userid format)"
>>   Require valid-user
>> 
>>
>> I then had to upgrade Apache/SSL to 2.4.23, 1.0.2h. With this upgrade, 
>> mod_python was obsoleted so I had to switch to use mod_wsgi load module. I 
>> added in the mod_wsgi.so load module and modified the config file to remove 
>> the Python-related settings (keeping the AuthzSVNAccessFile setting), and 
>> adding in mod_wsgi info.
>>
>> After the Apache upgrade, the httpd.conf file contained:
>>
>> 
>>   SVNParentPath e:/svn_repository
>>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>>   AuthType SSPI
>>   SSPIAuth On
>>   SSPIOfferSSPI Off
>>   SSPIAuthoritative On
>>   SSPIDomain 
>>   SSPIOmitDomain Off
>>   SSPIUsernameCase lower
>>   SSPIPerRequestAuth On
>>   SSPIOff

[Trac] Re: Trac not following SVN access control permissions after Apache upgrade

[Mary Loftis]

I just tried accessing svn through TortoiseSVN and it is letting me access 
the repo too. I shouldn't be allowed access to it. So I don't think it is 
necessarily a trac problem but an Apache config problem. I'll have to do 
some more investigation to figure out why it is letting me into the svn 
repo. I thought I had been properly blocked by TortoiseSVN, but maybe I 
confused my prod Apache server with my test (upgraded) Apache server. Back 
to the drawing board.

On Tuesday, August 23, 2016 at 11:59:05 AM UTC-4, Mary Loftis wrote:
>
> Platform: Windows Server 2008 R2 
> Apache 2.2.23 (win32)/SSL 1.0.0j upgrading to Apache 2.4.23 (win32)/SSL 
> 1.0.2h 
> CollabNet Subversion Client SVNServe 1.7.8
> Trac 1.0.9 (win32) 
> Python 2.7.1
>
> On a Windows server, I had Subversion and Trac interacting nicely when 
> running Apache 2.2.23, Subversion 1.7.8 with Trac 1.0.9 and the mod_python 
> module. Access to Trac projects was permitted based on access control 
> groups defined in the subversion access control file. The setting of the 
> AuthzSVNAccessFile variable in the httpd.conf file pointed to the 
> subversion access control file, e:/etc/.svnaccess. If the user had access 
> to a subversion repo, then they had access to the associated Trac project, 
> otherwise access was denied.
>
> The httpd.conf file contained the following:
>
> 
>   SVNParentPath e:/svn_repository
>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>   SetHandler mod_python
>   PythonHandler trac.web.modpython_frontend
>   PythonOption TracEnvParentDir e:\trac
>   PythonOption TracUriRoot /trac
>   AuthType SSPI
>   SSPIAuth On
>   SSPIOfferSSPI Off
>   SSPIAuthoritative On
>   SSPIDomain 
>   SSPIOmitDomain Off
>   SSPIUsernameCase lower
>   SSPIPerRequestAuth On
>   SSPIOfferBasic On
>   AuthName "UTAS TRAC Login (Use domain\userid format)"
>   Require valid-user
> 
>
> I then had to upgrade Apache/SSL to 2.4.23, 1.0.2h. With this upgrade, 
> mod_python was obsoleted so I had to switch to use mod_wsgi load module. I 
> added in the mod_wsgi.so load module and modified the config file to remove 
> the Python-related settings (keeping the AuthzSVNAccessFile setting), and 
> adding in mod_wsgi info.
>
> After the Apache upgrade, the httpd.conf file contained:
>
> 
>   SVNParentPath e:/svn_repository
>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>   AuthType SSPI
>   SSPIAuth On
>   SSPIOfferSSPI Off
>   SSPIAuthoritative On
>   SSPIDomain 
>   SSPIOmitDomain Off
>   SSPIUsernameCase lower
>   SSPIPerRequestAuth On
>   SSPIOfferBasic On
>   AuthName "UTAS TRAC Login (Use domain\userid format)"
>   Require valid-user
> 
>
> WSGIScriptAlias /trac e:/trac/trac.wsgi
>
> 
>WSGIApplicationGroup %{GLOBAL}
>Order deny,allow
>Allow from all
> 
>
>
> The e:/trac.wsgi has the following in it:
>
> import os
> import trac.web.main
> import site
>
> site.addsitedir('e:\Python\Lib\site-packages')
>
> os.environ['PYTHON_EGG_CACHE'] = r'c:\Trac-Python-Egg-Cache'
>
> def application(environ, start_response):
>   environ['trac.env_parent_dir'] = r'e:\trac' 
>   return trac.web.main.dispatch_request(environ, start_response)
>
> The trac.ini file (for Beth_test project) has these critical sections, 
> same as before the Apache upgrade:
>
>  [components]
> tracopt.versioncontrol.svn.* = enabled
> tracstats.* = enabled
>
> [repositories]
> Beth_test.dir = e:\svn_repository\Beth_test
> Beth_test.description = This is the ‘Beth_test’ project repository on the 
> Test svn server.
> Beth_test.type = svn
> Beth_test.url = https:///svn/Beth_test
> Beth_test.hidden = true
> tsvn = tsvn: Interact with TortoiseSvn
>
> [trac]
> authz_file = E:\etc\.svnaccess
> permission_policies = AuthzSourcePolicy, DefaultPermissionPolicy, 
> LegacyAttachmentPolicy
> permission_store = DefaultPermissionStore
> repository_dir = e:\svn_repository\Beth_test
> repository_type = svn
> …plus a bunch of other settings
>
>
> My directory structure on the server is:
>
>
> E:\svn_repository\
>
>Beth_test 
>
>SVN_test 
>
>
> E:\trac\ 
>
>Beth_test 
>
>SVN_test
>
>
> When I bring up the Trac url after entering my active directory 
> credentials, I see the 2 Trac projects listed. However when I click on a 
> project, it gives me access to it even though I have not added my id to the 
> access control group associated with the subversion Beth_test repo. With 
> TortoiseSVN I am properly blocked, but with Trac using the mod_wsgi module, 
> I can (erroneously) access the Trac project and subsequently browse the 
> subversion source.
>
>

[Trac] Re: Trac not following SVN access control permissions after Apache upgrade

[Mary Loftis]

See response to Jun. I got rid of mod_access_compat and switched to Require 
statements. Still lets browse the svn repo to which my id should not have 
access.

The svn access file contains the following. My id is utcaus\leftism. I am 
only in the admin group which has r/w access to /. I am not in the other 
groups which have access to the repos defined under slash.

   
 [groups]
admin = utcaus\loftism, utcaus\vasquer-a, utcaus\g0044320
#
SVNtestteam = utcaus\haugsch, utcaus\welcher, utcaus\vasquer-a, utcaus\
g0044320
#
Bethtestteam = utcaus\welcher, utcaus\vasquer-a, utcaus\g0044320
#
[/]
@admin = rw
# Allow developers complete access to their project repos
#
[SVN_test:/]
@SVNtestteam = rw
#
[Beth_test:/]
@Bethtestteam = rw

Thanks for the suggestion. Any more thoughts on the subject?

On Monday, September 26, 2016 at 11:35:15 AM UTC-4, RjOllos wrote:

>
>
> On Friday, September 23, 2016 at 10:56:54 PM UTC+1, Mary Loftis wrote:
>>
>> I had added the *mod_access_compat* 
>> <https://httpd.apache.org/docs/current/mod/mod_access_compat.html>  load 
>> module which was supposed to allow me to use the old Deny/Order type 
>> commands. Right now I'm having an issue with the server, so I can't test 
>> removing the mod_access_compat and trying the Require statement.
>>
>> Regarding mod_python...all the research I did indicated there wasn't a 
>> version of the mod_python load module for Apache 2.4 compatible with Python 
>> 2.7.1 for Windows Server 2008. Everything indicated to use mod_wsgi 
>> instead. If you know where I can get the mod_python load module (I can't be 
>> compiling it myself), then please provide the url. Thanks.
>>
>
> I'm not familiar with Windows server, though though 2008 is pretty much 
> end of life by now. I just wanted to clarify that mod_python could 
> generally be used, but mod_wsgi is a fine choice.
>
> When your server is in better shape, I'd disable the mod_access_compat 
> module and try to convert to the Apache 2.4 syntax. It's fairly 
> straightforward.
>
> - Ryan
>  
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

Re: [Trac] Trac not following SVN access control permissions after Apache upgrade

[Mary Loftis]

I set the authz_module_name = Beth_test in the trac.ini but it had no 
affect. I also removed the loading of mod_access_compat and switched to 
using the Require statements as is preferred with Apache 2.4.  It is 
sto;; letting me browse the svn repo even though the authz_file permissions 
do not list my id for that repo.

The svn access file contains the following. My id is utcaus\leftism. I am 
only in the admin group which has r/w access to /. I am not in the other 
groups which have access to the repos defined under slash.

   
 [groups]
admin = utcaus\loftism, utcaus\vasquer-a, utcaus\g0044320
#
SVNtestteam = utcaus\haugsch, utcaus\welcher, utcaus\vasquer-a, utcaus\
g0044320
#
Bethtestteam = utcaus\welcher, utcaus\vasquer-a, utcaus\g0044320
#
[/]
@admin = rw
# Allow developers complete access to their project repos
#
[SVN_test:/]
@SVNtestteam = rw
#
[Beth_test:/]
@Bethtestteam = rw

Thanks for the suggestion. Any more thoughts on the subject?


On Monday, September 26, 2016 at 12:29:19 PM UTC-4, Jun Omae wrote:

> On Wed, Aug 24, 2016 at 12:59 AM, Mary Loftis <mary@utas.utc.com 
> > wrote: 
> > The trac.ini file (for Beth_test project) has these critical sections, 
> same as before the Apache upgrade: 
> > ... 
> > [trac] 
> > authz_file = E:\etc\.svnaccess 
> > permission_policies = AuthzSourcePolicy, DefaultPermissionPolicy, 
> LegacyAttachmentPolicy 
> > permission_store = DefaultPermissionStore 
> > repository_dir = e:\svn_repository\Beth_test 
> > repository_type = svn 
> > …plus a bunch of other settings 
>
> I think it's needed to add authz_module_name option for default 
> repository in the Trac Environment. 
>
> [trac] 
> authz_module_name = Beth_test 
>
> -- 
> Jun Omae <jun...@gmail.com > (大前 潤) 
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

[Trac] Re: Trac not following SVN access control permissions after Apache upgrade

[Mary Loftis]

I had added the *mod_access_compat* 
<https://httpd.apache.org/docs/current/mod/mod_access_compat.html>  load 
module which was supposed to allow me to use the old Deny/Order type 
commands. Right now I'm having an issue with the server, so I can't test 
removing the mod_access_compat and trying the Require statement.

Regarding mod_python...all the research I did indicated there wasn't a 
version of the mod_python load module for Apache 2.4 compatible with Python 
2.7.1 for Windows Server 2008. Everything indicated to use mod_wsgi 
instead. If you know where I can get the mod_python load module (I can't be 
compiling it myself), then please provide the url. Thanks.

On Tuesday, August 23, 2016 at 5:20:42 PM UTC-4, RjOllos wrote:

>
>
> On Tuesday, August 23, 2016 at 8:59:05 AM UTC-7, Mary Loftis wrote:
>>
>> Platform: Windows Server 2008 R2 
>> Apache 2.2.23 (win32)/SSL 1.0.0j upgrading to Apache 2.4.23 (win32)/SSL 
>> 1.0.2h 
>> CollabNet Subversion Client SVNServe 1.7.8
>> Trac 1.0.9 (win32) 
>> Python 2.7.1
>>
>> On a Windows server, I had Subversion and Trac interacting nicely when 
>> running Apache 2.2.23, Subversion 1.7.8 with Trac 1.0.9 and the mod_python 
>> module. Access to Trac projects was permitted based on access control 
>> groups defined in the subversion access control file. The setting of the 
>> AuthzSVNAccessFile variable in the httpd.conf file pointed to the 
>> subversion access control file, e:/etc/.svnaccess. If the user had access 
>> to a subversion repo, then they had access to the associated Trac project, 
>> otherwise access was denied.
>>
>> The httpd.conf file contained the following:
>>
>> 
>>   SVNParentPath e:/svn_repository
>>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>>   SetHandler mod_python
>>   PythonHandler trac.web.modpython_frontend
>>   PythonOption TracEnvParentDir e:\trac
>>   PythonOption TracUriRoot /trac
>>   AuthType SSPI
>>   SSPIAuth On
>>   SSPIOfferSSPI Off
>>   SSPIAuthoritative On
>>   SSPIDomain 
>>   SSPIOmitDomain Off
>>   SSPIUsernameCase lower
>>   SSPIPerRequestAuth On
>>   SSPIOfferBasic On
>>   AuthName "UTAS TRAC Login (Use domain\userid format)"
>>   Require valid-user
>> 
>>
>> I then had to upgrade Apache/SSL to 2.4.23, 1.0.2h. With this upgrade, 
>> mod_python was obsoleted so I had to switch to use mod_wsgi load module. I 
>> added in the mod_wsgi.so load module and modified the config file to remove 
>> the Python-related settings (keeping the AuthzSVNAccessFile setting), and 
>> adding in mod_wsgi info.
>>
>
>
> mod_python is still actively developed. Do you mean that it was obsoleted 
> in the package management system for your OS?
>  
>
>> After the Apache upgrade, the httpd.conf file contained:
>>
>> 
>>   SVNParentPath e:/svn_repository
>>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>>   AuthType SSPI
>>   SSPIAuth On
>>   SSPIOfferSSPI Off
>>   SSPIAuthoritative On
>>   SSPIDomain 
>>   SSPIOmitDomain Off
>>   SSPIUsernameCase lower
>>   SSPIPerRequestAuth On
>>   SSPIOfferBasic On
>>   AuthName "UTAS TRAC Login (Use domain\userid format)"
>>   Require valid-user
>> 
>>
>> WSGIScriptAlias /trac e:/trac/trac.wsgi
>>
>> 
>>WSGIApplicationGroup %{GLOBAL}
>>Order deny,allow
>>Allow from all
>> 
>>
>>
>> The e:/trac.wsgi has the following in it:
>>
>> import os
>> import trac.web.main
>> import site
>>
>> site.addsitedir('e:\Python\Lib\site-packages')
>>
>> os.environ['PYTHON_EGG_CACHE'] = r'c:\Trac-Python-Egg-Cache'
>>
>> def application(environ, start_response):
>>   environ['trac.env_parent_dir'] = r'e:\trac' 
>>   return trac.web.main.dispatch_request(environ, start_response)
>>
>> The trac.ini file (for Beth_test project) has these critical sections, 
>> same as before the Apache upgrade:
>>
>>  [components]
>> tracopt.versioncontrol.svn.* = enabled
>> tracstats.* = enabled
>>
>> [repositories]
>> Beth_test.dir = e:\svn_repository\Beth_test
>> Beth_test.description = This is the ‘Beth_test’ project repository on the 
>> Test svn server.
>> Beth_test.type = svn
>> Beth_test.url = https:///svn/Beth_test
>> Beth_test.hidden = true
>> tsvn = tsvn: Interact with TortoiseSvn
>>
>> [trac]
>> authz_file = E:\etc\.svnaccess
>> permission_policies = AuthzSourcePolicy, DefaultPermissionPolicy, 
>> LegacyAttachmentPolicy
>> permi

[Trac] Trac not following SVN access control permissions after Apache upgrade

[Mary Loftis]

Platform: Windows Server 2008 R2 
Apache 2.2.23 (win32)/SSL 1.0.0j upgrading to Apache 2.4.23 (win32)/SSL 
1.0.2h 
CollabNet Subversion Client SVNServe 1.7.8
Trac 1.0.9 (win32) 
Python 2.7.1

On a Windows server, I had Subversion and Trac interacting nicely when 
running Apache 2.2.23, Subversion 1.7.8 with Trac 1.0.9 and the mod_python 
module. Access to Trac projects was permitted based on access control 
groups defined in the subversion access control file. The setting of the 
AuthzSVNAccessFile variable in the httpd.conf file pointed to the 
subversion access control file, e:/etc/.svnaccess. If the user had access 
to a subversion repo, then they had access to the associated Trac project, 
otherwise access was denied.

The httpd.conf file contained the following:


  SVNParentPath e:/svn_repository
  AuthzSVNAccessFile "E:/etc/.svnaccess"
  SetHandler mod_python
  PythonHandler trac.web.modpython_frontend
  PythonOption TracEnvParentDir e:\trac
  PythonOption TracUriRoot /trac
  AuthType SSPI
  SSPIAuth On
  SSPIOfferSSPI Off
  SSPIAuthoritative On
  SSPIDomain 
  SSPIOmitDomain Off
  SSPIUsernameCase lower
  SSPIPerRequestAuth On
  SSPIOfferBasic On
  AuthName "UTAS TRAC Login (Use domain\userid format)"
  Require valid-user


I then had to upgrade Apache/SSL to 2.4.23, 1.0.2h. With this upgrade, 
mod_python was obsoleted so I had to switch to use mod_wsgi load module. I 
added in the mod_wsgi.so load module and modified the config file to remove 
the Python-related settings (keeping the AuthzSVNAccessFile setting), and 
adding in mod_wsgi info.

After the Apache upgrade, the httpd.conf file contained:


  SVNParentPath e:/svn_repository
  AuthzSVNAccessFile "E:/etc/.svnaccess"
  AuthType SSPI
  SSPIAuth On
  SSPIOfferSSPI Off
  SSPIAuthoritative On
  SSPIDomain 
  SSPIOmitDomain Off
  SSPIUsernameCase lower
  SSPIPerRequestAuth On
  SSPIOfferBasic On
  AuthName "UTAS TRAC Login (Use domain\userid format)"
  Require valid-user


WSGIScriptAlias /trac e:/trac/trac.wsgi


   WSGIApplicationGroup %{GLOBAL}
   Order deny,allow
   Allow from all



The e:/trac.wsgi has the following in it:

import os
import trac.web.main
import site

site.addsitedir('e:\Python\Lib\site-packages')

os.environ['PYTHON_EGG_CACHE'] = r'c:\Trac-Python-Egg-Cache'

def application(environ, start_response):
  environ['trac.env_parent_dir'] = r'e:\trac' 
  return trac.web.main.dispatch_request(environ, start_response)

The trac.ini file (for Beth_test project) has these critical sections, same 
as before the Apache upgrade:

 [components]
tracopt.versioncontrol.svn.* = enabled
tracstats.* = enabled

[repositories]
Beth_test.dir = e:\svn_repository\Beth_test
Beth_test.description = This is the ‘Beth_test’ project repository on the 
Test svn server.
Beth_test.type = svn
Beth_test.url = https:///svn/Beth_test
Beth_test.hidden = true
tsvn = tsvn: Interact with TortoiseSvn

[trac]
authz_file = E:\etc\.svnaccess
permission_policies = AuthzSourcePolicy, DefaultPermissionPolicy, 
LegacyAttachmentPolicy
permission_store = DefaultPermissionStore
repository_dir = e:\svn_repository\Beth_test
repository_type = svn
…plus a bunch of other settings


My directory structure on the server is:


E:\svn_repository\

   Beth_test 

   SVN_test 


E:\trac\ 

   Beth_test 

   SVN_test


When I bring up the Trac url after entering my active directory 
credentials, I see the 2 Trac projects listed. However when I click on a 
project, it gives me access to it even though I have not added my id to the 
access control group associated with the subversion Beth_test repo. With 
TortoiseSVN I am properly blocked, but with Trac using the mod_wsgi module, 
I can (erroneously) access the Trac project and subsequently browse the 
subversion source.


There is nothing useful in the Apache or Trac log files.


Any idea why Trac no longer follows the subversion access control 
permissions after upgrading Apache and switching from mod_python to 
mod_wsgi?


-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

[Trac] Re: TRAC and SVN:Externals

[Mary Loftis]

Since we couldn't get the TRAC browsing working using the externals 
property, we opted to restructure our svn projects. Now all the TRAC 
projects will point to top-level svn folders. If time permits, I may 
continue to experiment. Thanks all.

On Thursday, April 14, 2016 at 4:01:59 PM UTC-4, Mary Loftis wrote:
>
> Am I misunderstanding the purpose of the TRAC svn:externals section? 
> Should I be able to browse the source for an external svn property from a 
> TRAC project when the svn repo to which TRAC project points contains an 
> external svn property?
>
>  
>
> Or is the TRAC svn:externals section used to point to a different TRAC 
> project associated with an svn file or folder listed under the TRAC 
> project’s browse source? 
>
> I have 2 svn repos. I use the same svn access control group to give users 
> the same access to the 2 repos.
>
>  
>
> SVN repo1 *https:///svn/AAA* <https://%3cmy_server%3e/svn/ares>
>
> This has svn folders under it, ws/sa/BBB
>
>  
>
> SVN repo2 *https:///svn/ BBB * 
> <https://%3cmy_server%3e/svn/%20B777X%20>
>
>   This has an svn external property which points to a subfolder 
> under AAA, *https:///svn/AAA/ws/sa/ BBB * 
> <https://%3cmy_server%3e/svn/ares/workspaces/systemarchive/b777x>
>
>  
>
> In TortoiseSVN, I can navigate through repo1, *https:///svn/AAA 
> and see repo2* <https://%3cmy_server%3e/svn/AAA%20and%20see%20repo2> 
> subfolders starting at https:///svn/AAA/ws/sa/ BBB.
>
>  
>
> I created a TRAC project, https:///trac/ BBB. 
>
>  
>
> Because TRAC projects seem to want to point to top-level svn folders and 
> not lower-level svn subfolders, I have it pointing to repo2, 
> https:///svn/ BBB.
>
>   
>
> In the trac.ini file:
>
>  
>
> [repositories]
>
> BBB.url = *https:///svn/BBB* 
> <https://%3cmy_server%3e/svn/B777X>
>
>  
>
> What I want to be able to do is in the TRAC BBB project, browse source so 
> it navigates into the repo1 subfolder starting at ws/sa/BBB. I therefore 
> added the following to the trac.ini file:
>
>  
>
> [svn:externals]
>
> 1 = svn:https://guswla02.utcapp.com/svn/AAA/ws/sa/BBB 
> https://guswla02.utcapp.com/trac/BBB/browser/$path?rev=$rev
>
>  
>
> When I open the BBB TRAC project and browse source, it shows the text, 
> “Property svn:externals set to 
> *https://guswla02.utcapp.com/svn/AAA/ws/sa/BBB* 
> <https://guswla02.utcapp.com/svn/ares/workspaces/systemarchive/B777X> BBB”
>
>  
>
> Note – there is no link, it is just plain text. I cannot browse the source 
> for the external svn property. Is this possible? If so, how?
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

Re: [Trac] TRAC and SVN:Externals

[Mary Loftis]

On Monday, April 18, 2016 at 5:42:00 PM UTC-4, RjOllos wrote:
>
>
>
> On Monday, April 18, 2016 at 6:57:43 AM UTC-7, Mary Loftis wrote:
>>
>> Yes, I have the [components] section with tracopt.versioncontrol.svn.* = 
>> enabled in it. 
>>
>
> Could you post a screen capture of the repository browser, or at least a 
> cropped section that shows the svn:externals plain text that you are 
> seeing? 
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

Re: [Trac] TRAC and SVN:Externals

[Mary Loftis]

Yes, I have the [components] section with tracopt.versioncontrol.svn.* = 
enabled in it. 

On Saturday, April 16, 2016 at 1:06:06 AM UTC-4, RjOllos wrote:
>
>
>
> On Fri, Apr 15, 2016 at 9:16 AM, Mary Loftis <mary@utas.utc.com 
> > wrote:
>
>> Thanks for the reply. I tried changing the svn:external line as 
>> indicated, but I still just get the same text displayed. It seems like it 
>> isn't even recognizing the change to the trac.ini file. I did a trac resync 
>> and restarted the apache service, just in case both of those were needed.
>>
>
> Have you enabled SubversionPropertyRenderer? You should have one of the 
> following rules in the [components] section:
>
> tracopt.versioncontrol.svn.* = enabled
> tracopt.versioncontrol.svn.svn_prop.* = enabled
> tracopt.versioncontrol.svn.svn_prop.SubversionPropertyRenderer = enabled
>  
>
>> So what does the svn:externals line 1 mean? Is it saying that to browse 
>> the svn BBB repo use the trac BBB browser? If so, why would I even need 
>> this line? BBB trac project is already associated with BBB svn repo. I need 
>> it to know to browse the svn external defined in the BBB repo (which is 
>> AAA/ws/sa/BBB)  with the Trac browser. Hope I'm making that clear.
>>
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

[Trac] Re: TRAC and SVN:Externals

[Mary Loftis]

On Thursday, April 14, 2016 at 4:01:59 PM UTC-4, Mary Loftis wrote:
>
> Am I misunderstanding the purpose of the TRAC svn:externals section? 
> Should I be able to browse the source for an external svn property from a 
> TRAC project when the svn repo to which TRAC project points contains an 
> external svn property?
>
>  
>
> Or is the TRAC svn:externals section used to point to a different TRAC 
> project associated with an svn file or folder listed under the TRAC 
> project’s browse source? 
>
> I have 2 svn repos. I use the same svn access control group to give users 
> the same access to the 2 repos.
>
>  
>
> SVN repo1 *https:///svn/AAA* <https://%3cmy_server%3e/svn/ares>
>
> This has svn folders under it, ws/sa/BBB
>
>  
>
> SVN repo2 *https:///svn/ BBB * 
> <https://%3cmy_server%3e/svn/%20B777X%20>
>
>   This has an svn external property which points to a subfolder 
> under AAA, *https:///svn/AAA/ws/sa/ BBB * 
> <https://%3cmy_server%3e/svn/ares/workspaces/systemarchive/b777x>
>
>  
>
> In TortoiseSVN, I can navigate through repo1, *https:///svn/AAA 
> and see repo2* <https://%3cmy_server%3e/svn/AAA%20and%20see%20repo2> 
> subfolders starting at https:///svn/AAA/ws/sa/ BBB.
>
>  
>
> I created a TRAC project, https:///trac/ BBB. 
>
>  
>
> Because TRAC projects seem to want to point to top-level svn folders and 
> not lower-level svn subfolders, I have it pointing to repo2, 
> https:///svn/ BBB.
>
>   
>
> In the trac.ini file:
>
>  
>
> [repositories]
>
> BBB.url = *https:///svn/BBB* 
> <https://%3cmy_server%3e/svn/B777X>
>
>  
>
> What I want to be able to do is in the TRAC BBB project, browse source so 
> it navigates into the repo1 subfolder starting at ws/sa/BBB. I therefore 
> added the following to the trac.ini file:
>
>  
>
> [svn:externals]
>
> 1 = svn:https://guswla02.utcapp.com/svn/AAA/ws/sa/BBB 
> https://guswla02.utcapp.com/trac/BBB/browser/$path?rev=$rev
>
>  
>
> When I open the BBB TRAC project and browse source, it shows the text, 
> “Property svn:externals set to 
> *https://guswla02.utcapp.com/svn/AAA/ws/sa/BBB* 
> <https://guswla02.utcapp.com/svn/ares/workspaces/systemarchive/B777X> BBB”
>
>  
>
> Note – there is no link, it is just plain text. I cannot browse the source 
> for the external svn property. Is this possible? If so, how?
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

Re: [Trac] TRAC and SVN:Externals

[Mary Loftis]

Thanks for the reply. I tried changing the svn:external line as indicated, 
but I still just get the same text displayed. It seems like it isn't even 
recognizing the change to the trac.ini file. I did a trac resync and 
restarted the apache service, just in case both of those were needed. 

So what does the svn:externals line 1 mean? Is it saying that to browse the 
svn BBB repo use the trac BBB browser? If so, why would I even need this 
line? BBB trac project is already associated with BBB svn repo. I need it 
to know to browse the svn external defined in the BBB repo (which is 
AAA/ws/sa/BBB)  with the Trac browser. Hope I'm making that clear.

On Thursday, April 14, 2016 at 10:18:28 PM UTC-4, Jun Omae wrote:

> On Fri, Apr 15, 2016 at 5:01 AM, Mary Loftis <mary@utas.utc.com 
> > wrote: 
> > [svn:externals] 
> > 1 = svn:https://guswla02.utcapp.com/svn/AAA/ws/sa/BBB 
> https://guswla02.utcapp.com/trac/BBB/browser/$path?rev=$rev 
>
> The svn:https://guswla02.utcapp.com/svn/AAA/ws/sa/BBB isn't valid URL. 
> It should be: 
>
> 1 = https://guswla02.utcapp.com/svn/BBB 
> https://guswla02.utcapp.com/trac/BBB/browser/$path?rev=$rev 
>
>
> -- 
> Jun Omae <jun...@gmail.com > (大前 潤) 
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

[Trac] TRAC and SVN:Externals

[Mary Loftis]

 

Am I misunderstanding the purpose of the TRAC svn:externals section? Should 
I be able to browse the source for an external svn property from a TRAC 
project when the svn repo to which TRAC project points contains an external 
svn property?

 

Or is the TRAC svn:externals section used to point to a different TRAC 
project associated with an svn file or folder listed under the TRAC 
project’s browse source? 

I have 2 svn repos. I use the same svn access control group to give users 
the same access to the 2 repos.

 

SVN repo1 *https:///svn/AAA* 

This has svn folders under it, ws/sa/BBB

 

SVN repo2 *https:///svn/ BBB * 


  This has an svn external property which points to a subfolder 
under AAA, *https:///svn/AAA/ws/sa/ BBB * 


 

In TortoiseSVN, I can navigate through repo1, *https:///svn/AAA 
and see repo2*  
subfolders starting at https:///svn/AAA/ws/sa/ BBB.

 

I created a TRAC project, https:///trac/ BBB. 

 

Because TRAC projects seem to want to point to top-level svn folders and 
not lower-level svn subfolders, I have it pointing to repo2, 
https:///svn/ BBB.

  

In the trac.ini file:

 

[repositories]

BBB.url = *https:///svn/BBB* 

 

What I want to be able to do is in the TRAC BBB project, browse source so 
it navigates into the repo1 subfolder starting at ws/sa/BBB. I therefore 
added the following to the trac.ini file:

 

[svn:externals]

1 = svn:https://guswla02.utcapp.com/svn/AAA/ws/sa/BBB 
https://guswla02.utcapp.com/trac/BBB/browser/$path?rev=$rev

 

When I open the BBB TRAC project and browse source, it shows the text, 
“Property svn:externals set to 
*https://guswla02.utcapp.com/svn/AAA/ws/sa/BBB* 
 BBB”

 

Note – there is no link, it is just plain text. I cannot browse the source 
for the external svn property. Is this possible? If so, how?

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

[Trac] Re: TRAC permissions not following subversion permissions

[Mary Loftis]

I tried changing the [repositories] section to remove the 
ARES_ComponentLibrary prefix. Same error.

When I am not a member of the admin group and therefore do not have read 
access to the slash (/) directory, this is the error in the error.log file. 
(A replaced server and ip addresses with  and .)

[Thu Apr 14 08:40:38 2016] [info] Subsequent (No.2) HTTPS request received 
for child 245 (server :443)

[Thu Apr 14 08:40:38 2016] [debug] mod_authz_svn.c(195): [client ] 
Path to authz file is E:/etc/.svnaccess, referer: 
https:///trac/

[Thu Apr 14 08:40:38 2016] [error] [client ] Access denied: 
'utcaus\\loftism' GET ARES_ComponentLibrary:/, referer: 
https:///trac/

[Thu Apr 14 08:40:43 2016] [debug] ssl_engine_io.c(1908): OpenSSL: I/O 
error, 5 bytes expected to read on BIO#b870e0 [mem: 10dc55b]

[Thu Apr 14 08:40:43 2016] [info] [client ] (OS 10060)A connection 
attempt failed because the connected party did not properly respond after a 
period of time, or established connection failed because connected host has 
failed to respond.  : SSL input filter read failed.

[Thu Apr 14 08:40:43 2016] [debug] ssl_engine_kernel.c(1910): OpenSSL: 
Write: SSL negotiation finished successfully

[Thu Apr 14 08:40:43 2016] [info] [client ] Connection closed to 
child 245 with standard shutdown (server :443)

When I am a member of the admin group and have read access to the slash (/) 
directory, this is what I see in the error.log file - a successful 
connection:

[Thu Apr 14 08:43:48 2016] [debug] mod_authz_svn.c(195): [client ] 
Path to authz file is E:/etc/.svnaccess, referer: 
https:///trac/ARES_ComponentLibrary

[Thu Apr 14 08:43:48 2016] [info] [client ] Access granted: 
'utcaus\\loftism' GET ARES_ComponentLibrary:/chrome/common/extlink.gif, 
referer: https:///trac/ARES_ComponentLibrary

[Thu Apr 14 08:43:48 2016] [debug] ssl_engine_io.c(1908): OpenSSL: I/O 
error, 5 bytes expected to read on BIO#b870e0 [mem: cbcf3e3]

[Thu Apr 14 08:43:48 2016] [info] [client ] (70014)End of file 
found: SSL input filter read failed.

[Thu Apr 14 08:43:48 2016] [debug] ssl_engine_kernel.c(1910): OpenSSL: 
Write: SSL negotiation finished successfully

[Thu Apr 14 08:43:48 2016] [info] [client ] Connection closed to 
child 249 with standard shutdown (server :443)


I am going to attempt to create a top-level  svn repo (call it 
ACompLib) and have it contain a subversion external to the 
ARES\ComponentLibrary area. I will set the permission on ACompLib to use 
the same access control group used at the ARES\ComponentLibrary.  I will 
then create a TRAC project called ACompLib which points to the svn repo 
ACompLib. I'm hoping that by having the TRAC project point to a top-level 
svn repo, and having that svn repo have the same permissions as the 
lower-level directory in the other subversion repo with an subversion 
external to it, that TRAC will use the correct permissions.


On Monday, April 11, 2016 at 11:03:19 AM UTC-4, Mary Loftis wrote:

> I am having an issue with TRAC not adhering to the Subversion access 
> control permissions. 
>
>  
>
> Platform/Authentication Info
>
> OS: Windows Server 2008 R2 Standard SP1 (64 bit)
>
> Service: CollabNet Subversion Apache 2.2.23 (win32)
>
> Service: CollabNet Subversion Client svnserver v1.7.8
>
> Client App: Tortoise SVN v1.8.11.26382 (64 bit)
>
> Authentication: Apache using SSPI
>
>  
>
> ===
>
> In the httpd.conf file:
>
>  
>
> # Among other load modules used are the following:
>
> LoadModule authn_default_module modules/mod_authn_default.so
>
> LoadModule authn_file_module modules/mod_authn_file.so
>
> LoadModule authz_default_module modules/mod_authz_default.so
>
> LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
>
> LoadModule authz_host_module modules/mod_authz_host.so
>
> LoadModule authz_user_module modules/mod_authz_user.so
>
> LoadModule sspi_auth_module modules/mod_auth_sspi.so
>
> LoadModule  authz_svn_module   modules/mod_authz_svn.so
>
>  
>
> 
>
>DAV svn
>
>SVNParentPath e:/svn_repository
>
>SVNIndexXSLT/manual/style/xsl/svnindex.xsl 
>
>AuthType SSPI
>
>SSPIAuth On
>
>SSPIOfferSSPI Off
>
>SSPIAuthoritative On
>
>SSPIDomain 
>
># Specify domain\userid in .svnaccess file so set SSPIOmitDomain to off.
>
>SSPIOmitDomain Off
>
>SSPIUsernameCase lower
>
>SSPIPerRequestAuth On
>
>SSPIOfferBasic On
>
>AuthName " Subversion Login (Use domain\userid format)"
>
># Specify which users are allowed to access which svn projects
>
>AuthzSVNAccessFile "E:/etc/.svnaccess"
>
>Require valid-user
>
> 
>
>  
>
> 
>
>   SVNParentPath e:/svn_repository
>
>   AuthzSV

[Trac] Re: TRAC permissions not following subversion permissions

[Mary Loftis]

On Wednesday, April 13, 2016 at 4:44:58 PM UTC-4, RjOllos wrote:
>
>
>
> On Monday, April 11, 2016 at 8:03:19 AM UTC-7, Mary Loftis wrote:
>>
>> I am having an issue with TRAC not adhering to the Subversion access 
>> control permissions. 
>>
>>  
>>
>> Platform/Authentication Info
>>
>> OS: Windows Server 2008 R2 Standard SP1 (64 bit)
>>
>> Service: CollabNet Subversion Apache 2.2.23 (win32)
>>
>> Service: CollabNet Subversion Client svnserver v1.7.8
>>
>> Client App: Tortoise SVN v1.8.11.26382 (64 bit)
>>
>> Authentication: Apache using SSPI
>>
>>  
>>
>> ===
>>
>> In the httpd.conf file:
>>
>>  
>>
>> # Among other load modules used are the following:
>>
>> LoadModule authn_default_module modules/mod_authn_default.so
>>
>> LoadModule authn_file_module modules/mod_authn_file.so
>>
>> LoadModule authz_default_module modules/mod_authz_default.so
>>
>> LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
>>
>> LoadModule authz_host_module modules/mod_authz_host.so
>>
>> LoadModule authz_user_module modules/mod_authz_user.so
>>
>> LoadModule sspi_auth_module modules/mod_auth_sspi.so
>>
>> LoadModule  authz_svn_module   modules/mod_authz_svn.so
>>
>>  
>>
>> 
>>
>>DAV svn
>>
>>SVNParentPath e:/svn_repository
>>
>>SVNIndexXSLT/manual/style/xsl/svnindex.xsl 
>>
>>AuthType SSPI
>>
>>SSPIAuth On
>>
>>SSPIOfferSSPI Off
>>
>>SSPIAuthoritative On
>>
>>SSPIDomain 
>>
>># Specify domain\userid in .svnaccess file so set SSPIOmitDomain to 
>> off.
>>
>>SSPIOmitDomain Off
>>
>>SSPIUsernameCase lower
>>
>>SSPIPerRequestAuth On
>>
>>SSPIOfferBasic On
>>
>>AuthName " Subversion Login (Use domain\userid format)"
>>
>># Specify which users are allowed to access which svn projects
>>
>>AuthzSVNAccessFile "E:/etc/.svnaccess"
>>
>>Require valid-user
>>
>> 
>>
>>  
>>
>> 
>>
>>   SVNParentPath e:/svn_repository
>>
>>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>>
>>  
>>
>>   SetHandler mod_python
>>
>>   PythonHandler trac.web.modpython_frontend
>>
>>   PythonOption TracEnvParentDir e:\trac
>>
>>   # Location and TracUriRoot have the same path
>>
>>   # TracUriRoot may or may not be necessary in your setup.
>>
>>  PythonOption TracUriRoot /trac
>>
>>  
>>
>>   AuthType SSPI
>>
>>   SSPIAuth On
>>
>>   SSPIOfferSSPI Off
>>
>>   SSPIAuthoritative On
>>
>>   SSPIDomain 
>>
>>   SSPIOmitDomain Off
>>
>>   SSPIUsernameCase lower
>>
>>   SSPIPerRequestAuth On
>>
>>   SSPIOfferBasic On
>>
>>   AuthName "TRAC Login (Use domain\userid format)"
>>
>>   Require valid-user
>>
>> 
>>
>>  
>>
>> 
>>
>>   AuthType SSPI
>>
>>   AuthName "Trac Login"
>>
>>   SSPIAuth On
>>
>>   SSPIAuthoritative On
>>
>>   SSPIDomain MyLocalDomain
>>
>>   SSPIOfferBasic On
>>
>>   SSPIOmitDomain Off
>>
>>   SSPIBasicPreferred On
>>
>>   Require valid-user
>>
>> 
>>
>>  
>>
>> #Include e:/etc/subversion.conf
>>
>>  
>>
>> ===
>>
>> In the e:/etc/subversion.conf file:
>>
>>  
>>
>>  
>>
>>   DAV svn 
>>
>>   SVNPath E:/svn_repository/ARES
>>
>>   AuthType Basic 
>>
>>   AuthName "Subversion ARES repository" 
>>
>>   Require valid-user 
>>
>>   ErrorDocument 404 default 
>>
>> 
>>
>>  
>>
>>  
>>
>> Svn repo for which a TRAC project has been created is 
>> E:\svn_repository\ARES.
>>
>>  
>>
>> On the server, E:\svn_repository\ARES contains the following folders:
>>
>>   Conf
>>
>>   Dav
>>
>>   Db
>>
>>   Hooks
>>
>>   Locks
>>
>>  
>>
>>   And the following files:
>>
>>  
>>
>>   Format
>>
>>   

Re: [Trac] TRAC project for subfolder off Subversion repository

[Mary Loftis]

Well, I thought we had it working but saw odd behavior with permissions. 
Users had to have read access to the / repo in order to have access to the 
TRAC project. So that's not right. We only have admins have access to the / 
level. I posted a new question on the site about that issue.

On Tuesday, April 5, 2016 at 5:29:59 PM UTC-4, Mary Loftis wrote:
>
> Thanks - I will give it a try. It is just confusing that the 
> BBB.dir setting is to a folder that doesn't exist on the network.
>
> On Friday, April 1, 2016 at 12:37:37 AM UTC-4, RjOllos wrote:
>>
>>
>>
>> On Thursday, March 31, 2016 at 10:28:28 AM UTC-7, Jun Omae wrote:
>>>
>>> On Wed, Mar 30, 2016 at 4:28 AM, Mary Loftis <mary@utas.utc.com> 
>>> wrote: 
>>>
>>> > Rather than creating a TRAC project pointing to 
>>>  e:\svn_repository\BBB, I 
>>> > want to point it to the ComponentLibrary folder under 
>>> e:\svn_repository\BBB, 
>>> > however there is no folder on the server called ComponentLibrary. What 
>>> would 
>>> > I have to do in the trac.ini file to be able to set the TRAC project 
>>> at this 
>>> > lower subversion level? 
>>>
>>> Trac supports scoped repository for Subversion. You can configure like 
>>> this. 
>>>
>>> [repositories] 
>>> BBB.description = This is the ComponentLibrary under BBB project 
>>> repository. 
>>> BBB.dir = e:\svn_repository\BBB\ComponentLibrary 
>>> BBB.type = svn 
>>> BBB.url = https:///svn/BBB/ComponentLibrary 
>>>
>>>
>>> At least, on Linux, Subversion repository path with sub-entry works 
>>> well. 
>>> (/home/jun66j5/var/svn/trac.edgewall.org is path of Subversion 
>>> repository) 
>>>
>>> Trac [/home/jun66j5/var/trac/1.0-sqlite]> repository list 
>>>
>>> NameType  Alias  Directory 
>>> 
>>>  
>>>
>>> 1.0-stable  svn 
>>> /home/jun66j5/var/svn/trac.edgewall.org/branches/1.0-stable 
>>> testtest  empty.svn 
>>> trac.svnsvn  /home/jun66j5/var/svn/trac.edgewall.org 
>>>
>>
>> Thanks, I thought the feature sounded familiar, but I couldn't find it 
>> documented anywhere. I'll review documentation and add some notes if needed.
>>
>> - Ryan 
>>
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

Re: [Trac] TRAC project for subfolder off Subversion repository

[Mary Loftis]

On Tuesday, April 5, 2016 at 5:29:59 PM UTC-4, Mary Loftis wrote:
>
> Thanks - I will give it a try. It is just confusing that the 
> BBB.dir setting is to a folder that doesn't exist on the network.
>
> On Friday, April 1, 2016 at 12:37:37 AM UTC-4, RjOllos wrote:
>>
>>
>>
>> On Thursday, March 31, 2016 at 10:28:28 AM UTC-7, Jun Omae wrote:
>>>
>>> On Wed, Mar 30, 2016 at 4:28 AM, Mary Loftis <mary@utas.utc.com> 
>>> wrote: 
>>>
>>> > Rather than creating a TRAC project pointing to 
>>>  e:\svn_repository\BBB, I 
>>> > want to point it to the ComponentLibrary folder under 
>>> e:\svn_repository\BBB, 
>>> > however there is no folder on the server called ComponentLibrary. What 
>>> would 
>>> > I have to do in the trac.ini file to be able to set the TRAC project 
>>> at this 
>>> > lower subversion level? 
>>>
>>> Trac supports scoped repository for Subversion. You can configure like 
>>> this. 
>>>
>>> [repositories] 
>>> BBB.description = This is the ComponentLibrary under BBB project 
>>> repository. 
>>> BBB.dir = e:\svn_repository\BBB\ComponentLibrary 
>>> BBB.type = svn 
>>> BBB.url = https:///svn/BBB/ComponentLibrary 
>>>
>>>
>>> At least, on Linux, Subversion repository path with sub-entry works 
>>> well. 
>>> (/home/jun66j5/var/svn/trac.edgewall.org is path of Subversion 
>>> repository) 
>>>
>>> Trac [/home/jun66j5/var/trac/1.0-sqlite]> repository list 
>>>
>>> NameType  Alias  Directory 
>>> 
>>>  
>>>
>>> 1.0-stable  svn 
>>> /home/jun66j5/var/svn/trac.edgewall.org/branches/1.0-stable 
>>> testtest  empty.svn 
>>> trac.svnsvn  /home/jun66j5/var/svn/trac.edgewall.org 
>>>
>>
>> Thanks, I thought the feature sounded familiar, but I couldn't find it 
>> documented anywhere. I'll review documentation and add some notes if needed.
>>
>> - Ryan 
>>
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

[Trac] Re: TRAC permissions not following subversion permissions

[Mary Loftis]

On Monday, April 11, 2016 at 11:03:19 AM UTC-4, Mary Loftis wrote:
>
> I am having an issue with TRAC not adhering to the Subversion access 
> control permissions. 
>
>  
>
> Platform/Authentication Info
>
> OS: Windows Server 2008 R2 Standard SP1 (64 bit)
>
> Service: CollabNet Subversion Apache 2.2.23 (win32)
>
> Service: CollabNet Subversion Client svnserver v1.7.8
>
> Client App: Tortoise SVN v1.8.11.26382 (64 bit)
>
> Authentication: Apache using SSPI
>
 TRAC 1.0.9 Win32 for Python 

>  
>
> ===
>
> In the httpd.conf file:
>
>  
>
> # Among other load modules used are the following:
>
> LoadModule authn_default_module modules/mod_authn_default.so
>
> LoadModule authn_file_module modules/mod_authn_file.so
>
> LoadModule authz_default_module modules/mod_authz_default.so
>
> LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
>
> LoadModule authz_host_module modules/mod_authz_host.so
>
> LoadModule authz_user_module modules/mod_authz_user.so
>
> LoadModule sspi_auth_module modules/mod_auth_sspi.so
>
> LoadModule  authz_svn_module   modules/mod_authz_svn.so
>
>  
>
> 
>
>DAV svn
>
>SVNParentPath e:/svn_repository
>
>SVNIndexXSLT/manual/style/xsl/svnindex.xsl 
>
>AuthType SSPI
>
>SSPIAuth On
>
>SSPIOfferSSPI Off
>
>SSPIAuthoritative On
>
>SSPIDomain 
>
># Specify domain\userid in .svnaccess file so set SSPIOmitDomain to off.
>
>SSPIOmitDomain Off
>
>SSPIUsernameCase lower
>
>SSPIPerRequestAuth On
>
>SSPIOfferBasic On
>
>AuthName " Subversion Login (Use domain\userid format)"
>
># Specify which users are allowed to access which svn projects
>
>AuthzSVNAccessFile "E:/etc/.svnaccess"
>
>Require valid-user
>
> 
>
>  
>
> 
>
>   SVNParentPath e:/svn_repository
>
>   AuthzSVNAccessFile "E:/etc/.svnaccess"
>
>  
>
>   SetHandler mod_python
>
>   PythonHandler trac.web.modpython_frontend
>
>   PythonOption TracEnvParentDir e:\trac
>
>   # Location and TracUriRoot have the same path
>
>   # TracUriRoot may or may not be necessary in your setup.
>
>  PythonOption TracUriRoot /trac
>
>  
>
>   AuthType SSPI
>
>   SSPIAuth On
>
>   SSPIOfferSSPI Off
>
>   SSPIAuthoritative On
>
>   SSPIDomain 
>
>   SSPIOmitDomain Off
>
>   SSPIUsernameCase lower
>
>   SSPIPerRequestAuth On
>
>   SSPIOfferBasic On
>
>   AuthName "TRAC Login (Use domain\userid format)"
>
>   Require valid-user
>
> 
>
>  
>
> 
>
>   AuthType SSPI
>
>   AuthName "Trac Login"
>
>   SSPIAuth On
>
>   SSPIAuthoritative On
>
>   SSPIDomain MyLocalDomain
>
>   SSPIOfferBasic On
>
>   SSPIOmitDomain Off
>
>   SSPIBasicPreferred On
>
>   Require valid-user
>
> 
>
>  
>
> #Include e:/etc/subversion.conf
>
>  
>
> ===
>
> In the e:/etc/subversion.conf file:
>
>  
>
>  
>
>   DAV svn 
>
>   SVNPath E:/svn_repository/ARES
>
>   AuthType Basic 
>
>   AuthName "Subversion ARES repository" 
>
>   Require valid-user 
>
>   ErrorDocument 404 default 
>
> 
>
>  
>
>  
>
> Svn repo for which a TRAC project has been created is 
> E:\svn_repository\ARES.
>
>  
>
> On the server, E:\svn_repository\ARES contains the following folders:
>
>   Conf
>
>   Dav
>
>   Db
>
>   Hooks
>
>   Locks
>
>  
>
>   And the following files:
>
>  
>
>   Format
>
>   Readme.txt
>
>  
>
> ===
>
>  
>
> In the svn access control file, e:\etc\.svnaccess, is:
>
>  
>
> # Groups are defined.
>
> [groups]
>
> admin = domain\beth, domain\eric
>
> ARES_team = domain\beth, domain\eric, domain\greg, domain\joseph
>
>  
>
> # Access to the top-level / directory is only for the admin group.
>
> [/]
>
> @admin = rw
>
>  
>
> # Access to the ARES folder is forbidden for all.
>
> [ARES:/]
>
> * =
>
>  
>
> # Access to subfolders under the ARES area is allowed.
>
> [ARES:/ComponentLibrary]
>
> @ARES_team = rw
>
>  
>
> ===
>
>  
>
> Access to the repositories works as it should for all users when using 
> TortoiseSVN. Only admins have access to

[Trac] TRAC permissions not following subversion permissions

[Mary Loftis]

 

I am having an issue with TRAC not adhering to the Subversion access 
control permissions. 

 

Platform/Authentication Info

OS: Windows Server 2008 R2 Standard SP1 (64 bit)

Service: CollabNet Subversion Apache 2.2.23 (win32)

Service: CollabNet Subversion Client svnserver v1.7.8

Client App: Tortoise SVN v1.8.11.26382 (64 bit)

Authentication: Apache using SSPI

 

===

In the httpd.conf file:

 

# Among other load modules used are the following:

LoadModule authn_default_module modules/mod_authn_default.so

LoadModule authn_file_module modules/mod_authn_file.so

LoadModule authz_default_module modules/mod_authz_default.so

LoadModule authz_groupfile_module modules/mod_authz_groupfile.so

LoadModule authz_host_module modules/mod_authz_host.so

LoadModule authz_user_module modules/mod_authz_user.so

LoadModule sspi_auth_module modules/mod_auth_sspi.so

LoadModule  authz_svn_module   modules/mod_authz_svn.so

 



   DAV svn

   SVNParentPath e:/svn_repository

   SVNIndexXSLT/manual/style/xsl/svnindex.xsl 

   AuthType SSPI

   SSPIAuth On

   SSPIOfferSSPI Off

   SSPIAuthoritative On

   SSPIDomain 

   # Specify domain\userid in .svnaccess file so set SSPIOmitDomain to off.

   SSPIOmitDomain Off

   SSPIUsernameCase lower

   SSPIPerRequestAuth On

   SSPIOfferBasic On

   AuthName " Subversion Login (Use domain\userid format)"

   # Specify which users are allowed to access which svn projects

   AuthzSVNAccessFile "E:/etc/.svnaccess"

   Require valid-user



 



  SVNParentPath e:/svn_repository

  AuthzSVNAccessFile "E:/etc/.svnaccess"

 

  SetHandler mod_python

  PythonHandler trac.web.modpython_frontend

  PythonOption TracEnvParentDir e:\trac

  # Location and TracUriRoot have the same path

  # TracUriRoot may or may not be necessary in your setup.

 PythonOption TracUriRoot /trac

 

  AuthType SSPI

  SSPIAuth On

  SSPIOfferSSPI Off

  SSPIAuthoritative On

  SSPIDomain 

  SSPIOmitDomain Off

  SSPIUsernameCase lower

  SSPIPerRequestAuth On

  SSPIOfferBasic On

  AuthName "TRAC Login (Use domain\userid format)"

  Require valid-user



 



  AuthType SSPI

  AuthName "Trac Login"

  SSPIAuth On

  SSPIAuthoritative On

  SSPIDomain MyLocalDomain

  SSPIOfferBasic On

  SSPIOmitDomain Off

  SSPIBasicPreferred On

  Require valid-user



 

#Include e:/etc/subversion.conf

 

===

In the e:/etc/subversion.conf file:

 

 

  DAV svn 

  SVNPath E:/svn_repository/ARES

  AuthType Basic 

  AuthName "Subversion ARES repository" 

  Require valid-user 

  ErrorDocument 404 default 



 

 

Svn repo for which a TRAC project has been created is 
E:\svn_repository\ARES.

 

On the server, E:\svn_repository\ARES contains the following folders:

  Conf

  Dav

  Db

  Hooks

  Locks

 

  And the following files:

 

  Format

  Readme.txt

 

===

 

In the svn access control file, e:\etc\.svnaccess, is:

 

# Groups are defined.

[groups]

admin = domain\beth, domain\eric

ARES_team = domain\beth, domain\eric, domain\greg, domain\joseph

 

# Access to the top-level / directory is only for the admin group.

[/]

@admin = rw

 

# Access to the ARES folder is forbidden for all.

[ARES:/]

* =

 

# Access to subfolders under the ARES area is allowed.

[ARES:/ComponentLibrary]

@ARES_team = rw

 

===

 

Access to the repositories works as it should for all users when using 
TortoiseSVN. Only admins have access to the slash repo. No one can access 
the ARES repo. Members of the ARES_team can access the 
ARES/ComponentLibrary repo.

 

We want a TRAC project which points to the ARES/ComponentLibrary area. The 
following TRAC project is set up associated with the svn repo:

 

[components]

tracopt.versioncontrol.svn.* = enabled

tracstats.* = enabled

trac.versioncontrol.api.repositorymanager = enabled

trac.versioncontrol.svn_authz.svnauthzoptions = enabled

 

# This is an optional 'project root'

[stats]

root = e:\svn_repository\ARES\ComponentLibrary

 

[repositories]

#

# It should be noted that the path below doesn’t actually exist.

# There is no ComponentLibrary subfolder on the server, but it is 

# accessible from the TortoiseSVN repo browser at 

# https:///ARES/ComponentLibrary.
#

ARES_ComponentLibrary.dir = e:\svn_repository\ARES\ComponentLibrary

ARES_ComponentLibrary.description = This is the 'ARES Component Library' 
project repository.

ARES_ComponentLibrary.type = svn

ARES_ComponentLibrary.url = https:///svn/ARES/ComponentLibrary

ARES_ComponentLibrary.hidden = true

tsvn = tsvn: Interact with TortoiseSvn

 

[trac]

authz_file = E:\etc\.svnaccess

authz_module_name = ARES

permission_policies = AuthzSourcePolicy, DefaultPermissionPolicy, 
LegacyAttachmentPolicy

permission_store = DefaultPermissionStore

#

# It should be noted that the path below doesn’t 

Re: [Trac] TRAC project for subfolder off Subversion repository

[Mary Loftis]

Thanks - I will give it a try. It is just confusing that the 
BBB.dir setting is to a folder that doesn't exist on the network.

On Friday, April 1, 2016 at 12:37:37 AM UTC-4, RjOllos wrote:
>
>
>
> On Thursday, March 31, 2016 at 10:28:28 AM UTC-7, Jun Omae wrote:
>>
>> On Wed, Mar 30, 2016 at 4:28 AM, Mary Loftis <mary@utas.utc.com 
>> > wrote: 
>>
>> > Rather than creating a TRAC project pointing to  e:\svn_repository\BBB, 
>> I 
>> > want to point it to the ComponentLibrary folder under 
>> e:\svn_repository\BBB, 
>> > however there is no folder on the server called ComponentLibrary. What 
>> would 
>> > I have to do in the trac.ini file to be able to set the TRAC project at 
>> this 
>> > lower subversion level? 
>>
>> Trac supports scoped repository for Subversion. You can configure like 
>> this. 
>>
>> [repositories] 
>> BBB.description = This is the ComponentLibrary under BBB project 
>> repository. 
>> BBB.dir = e:\svn_repository\BBB\ComponentLibrary 
>> BBB.type = svn 
>> BBB.url = https:///svn/BBB/ComponentLibrary 
>>
>>
>> At least, on Linux, Subversion repository path with sub-entry works well. 
>> (/home/jun66j5/var/svn/trac.edgewall.org is path of Subversion 
>> repository) 
>>
>> Trac [/home/jun66j5/var/trac/1.0-sqlite]> repository list 
>>
>> NameType  Alias  Directory 
>> 
>>  
>>
>> 1.0-stable  svn 
>> /home/jun66j5/var/svn/trac.edgewall.org/branches/1.0-stable 
>> testtest  empty.svn 
>> trac.svnsvn  /home/jun66j5/var/svn/trac.edgewall.org 
>>
>
> Thanks, I thought the feature sounded familiar, but I couldn't find it 
> documented anywhere. I'll review documentation and add some notes if needed.
>
> - Ryan 
>

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.

[Trac] TRAC project for subfolder off Subversion repository

[Mary Loftis]

We have TRAC and Subversion set up in the following environment:

Platform: Windows Server 2008 R2 Standard SP1 (64 bit)
Service: CollabNet Subversion Apache, Apache 2.2.23 (win32)
Service: CollabNet Subversion Client Svnserve V1.7.8
Desktop App: Tortoise SVN Client V1.7.8 (64 bit)

TRAC uses the Subversion access control file for granting/denying access to 
TRAC projects.
 
When setting up a TRAC project, it indicates you have to give the location 
of the Subversion repository. For most of our TRAC projects, this is fine. 
The top-level subversion directory located on the server is where we want 
to point TRAC. 
 
Assume subversion repositories on the server are located here:

e:\svn_repository\AAA
e:\svn_repository\BBB

We have a TRAC project pointing directly to the top-level svn folder, AAA. 
Key settings in the AAA trac.ini file are:

[components]
tracopt.versioncontrol.svn.* = enabled
 
[repositories]
AAA.description = This is the AAA project repository.
AAA.dir = e:\svn_repository\AAA
AAA.hidden = true
AAA.type = svn
AAA.url = https:///svn/AAA 
tsvn = tsvn: Interact with TortoiseSvn
 
[stats]
root = e:\svn_repository\AAA
 
[svn]
authz_file = E:\etc\.svnaccess # this is the same file subversion uses for 
authentication
 
[trac]
authz_file = E:\etc\.svnaccess  # this is the same file subversion uses for 
authentication
authz_module_name = AAA
repository_dir = e:\svn_repository\AAA

 
However we have some projects where we want to have TRAC point to a folder 
under the subversion repo's top-level folder. Because the directory 
structure for some repos is built into svn and are not folders under the 
top-level folder on the server, I do not know where to point certain TRAC 
variables in the trac.ini file.
 
The directory structure on the server for the repo e:\svn_repository\BBB 
shows the following folders and files:

(folder) conf
(folder) dav
(folder) db
(folder) hooks
(folder) locks
(file) format
(file README.txt

The subversion repo browser for e:\svn_repository\BBB shows the following:
 

(folder) ComponentLibrary

(folder) branches # This is a subfolder under ComponentLibrary
(folder) tags # This is a subfolder under ComponentLibrary
(folder) trunk# This is a subfolder under ComponentLibrary


Rather than creating a TRAC project pointing to  e:\svn_repository\BBB, I 
want to point it to the ComponentLibrary folder under 
e:\svn_repository\BBB, however there is no folder on the server called 
ComponentLibrary. What would I have to do in the trac.ini file to be able 
to set the TRAC project at this lower subversion level?
 
 
 
 
 
 
 
 
 

 

 

 
 

-- 
You received this message because you are subscribed to the Google Groups "Trac 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to trac-users+unsubscr...@googlegroups.com.
To post to this group, send email to trac-users@googlegroups.com.
Visit this group at https://groups.google.com/group/trac-users.
For more options, visit https://groups.google.com/d/optout.