Print

[stsp]

Hi,

it seems mod_dav_svn 1.8.8 is currently only available for HTTPD 2.4.
The mod_dav_svn version for HTTPD 2.2. is still 1.8.5.
Are there any plans to provide mod_dav_svn 1.8.8. for HTTPD 2.2?

Note that Subversion 1.8.8 contains this security fix:
http://subversion.apache.org/security/CVE-2014-0032-advisory.txt

Thank you!
Stefan

[mario]

I hoped I could discontinue the 2.2 builds. If you can't upgrade your apache to 2.4 I will a build. Latest at the weekend.
I wonder why you still run 2.2

[stsp]

I'm still running 2.2 because mod_auth_sspi is needed to authenticate against AD.

In my testing, the httpd 2.4 replacement (mod_auth_ntlm) doesn't seem to work correctly with 'require group' if the authenticating user is a member of a group which is a member of the group listed in the 'require group' clause. mod_auth_ntlm worked fine when I tried with 'require valid-user'. But I need 'require group'  and access is always denied in this case. The old mod_auth_sspi works fine in this configuration.

Sorry for the inconvenience.

[mario]

there are now the x86 and the x64 download.

Have fun!

[stsp]

Thanks a lot Mario! All is working fine and as expected.

I hope that mod_authn_ntlm will be fixed for our use case some day.
It would be especially nice if it was included in the upstream httpd distribution and maintained there.
I'll try to find time to find out what needs to be done for this to happen, and will try to talk to the httpd project if necessary.
In the meantime I'll be using the update you've provided, so thanks!

[Gregg]

It's based on mod_auth_sspi, it's 95% mod_auth_sspi, and it has been asked already. The author of mod_auth_sspi has not answered back so there is nothing the ASF can do.

There is a fork of mod_auth_sspi at sourceforge called mod_authnz_sspi for 2.4, it can be found here;
https://www.apachehaus.net/modules/mod_authnz_sspi/

You might want to try it out.

[stsp]

I wouldn't say it's 95% the same code. While many of the code changes made were just added comments, one file (which is called accesscheck.c in mod_auth_sspi and mod_ntlm_authorization.c in mod_authn_ntlm) was changed quite significantly. I would even say it was rewritten. I believe this is where the regression I'm seeing comes from (mod_authn_ntlm is looking for users in the wrong group during the authorization stage). But I'm not 100% sure.

Thanks for the mod_authz_sspi hint. I'll give it a try. I was under the impression that it was a precursor of mod_authn_ntlm.

[stsp]

I'm interested in any links you might have to ASF discussion on this topic, BTW.

Without having seen the discussion, I can imagine that one of the problems might have been getting a copyright licence agreement sorted out. The short two-liner of a copyright blurb given in mod_auth_sspi.c is probably too vague to comply with ASF licence policy. In which case any code derived from mod_auth_sspi would be unfit for official inclusion in apache httpd

[Gregg]

It was one developer asking the original author if he would be willing to donate it. No response, no need to go any further.

[pedro.vieira.11]

It was one developer asking the original author if he would be willing to donate it. No response, no need to go any further.

This only work with windows, that is some kind of module valid for Linux enviorement ? I have a centos with apache 2.2 and i want to use SSPI authentication.

Regards, Thanks in a advance

[mario]

SSPI is Windows only. But on Linux you can use mod auth kerb against AD / LDAP.

[kmradke]

Would it be too much to ask for a 1.8.10 x64 build for apache 2.2?

Unfortunately not running 2.4 yet on the Linux side and I'd rather keep versions the same on both platforms if possible.

Thanks!

[mario]

Would it be too much to ask for a 1.8.10 x64 build for apache 2.2?

Unfortunately not running 2.4 yet on the Linux side and I'd rather keep versions the same on both platforms if possible.

Thanks!

Well I can try this week, but I don't have much time and from the weekend I'llgone a for a few weeks.

Why don't you upgrade your apahze 2.4 on linux? Don't you build it yourself if your distro doesn't offer it. I could tell your how to.

[kmradke]

I do build from source on Linux.  I have a number of custom modules and was trying not to change too many variables at once.  I also build some custom modules on Windows, but haven't tackled a full svn build with all it's dependencies yet...

[mario]

I also build some custom modules on Windows, but haven't tackled a full svn build with all it's dependencies yet...

First of all you need a fully compiled apache with the sources stuff in for example C:\build\httpd-2.4.9-x64 and install python27 to C:\python27

Grab
http://subversion.apache.org/download/#recommended-release extract it to C:\build\subversion-1.8.10-x64
sqlite-amalgamation from http://www.sqlite.org/download.html rename it to sqlite-amalgamation in the C:\build\subversion-1.8.10-x64 folder
put NOT Compiled zlib into the source tree. Rename it to zlib in the C:\build\subversion-1.8.10-x64 folder

http://code.google.com/p/serf/downloads/list
1.2.1
Rename it to serf in the C:\build\subversion-1.8.10-x64 folder


--------------------------------------------------------------------
VC9 VC2008
--------------------------------------------------------------------
C:\python27\python gen-make.py --release -t vcproj --with-apr=C:\build\httpd-2.4.9-x64\srclib\apr --with-apr-util=C:\build\httpd-2.4.9-x64\srclib\apr-util --with-apr-iconv=C:\build\httpd-2.4.9-x64\srclib\apr-iconv --with-serf=C:\build\subversion-1.8.10-ap24-vc9-x64\serf --with-httpd=C:\build\httpd-2.4.9-x64 --with-openssl=C:\build\httpd-2.4.9-x64\srclib\openssl --with-zlib=C:\build\subversion-1.8.10-ap24-vc9-x64\zlib --vsnet-version=2008

Open generated build\win32\vcnet-vcproj\build_zlib.bat and insert at line 67 (before "set BUILD_OPTS=..." line):
set ASM_OPTS=AS=ml64 LOC="-DASMV -DASMINF -I." OBJA="inffasx64.obj gvmat64.obj inffas8664.obj"

open zlib\win32\Makefile.msc replace line 31 with
ASFLAGS = -coff -Zi -safeseh $(LOC)

Open the solution with the GUI. Change the Solution to Release and x64
compile in this order
   - zlib
   - serf
   - __ALL-TESTS__


Use create a batch script with the following code in C:\build\subversion-1.8.10-x64 and execute it.

with

Code: [Select]

@echo off
mkdir __PACKAGE__
cd __PACKAGE__
set SVN_PACKAGE_PATH=%cd%
mkdir bin
mkdir doc
mkdir modules
mkdir tools
cd ..
copy Release\subversion\libsvn_client\*.dll %SVN_PACKAGE_PATH%\bin
copy Release\subversion\libsvn_delta\*.dll %SVN_PACKAGE_PATH%\bin
copy Release\subversion\libsvn_diff\*.dll %SVN_PACKAGE_PATH%\bin
copy Release\subversion\libsvn_fs\*.dll %SVN_PACKAGE_PATH%\bin
copy Release\subversion\libsvn_ra\*.dll %SVN_PACKAGE_PATH%\bin
copy Release\subversion\libsvn_repos\*.dll %SVN_PACKAGE_PATH%\bin
copy Release\subversion\libsvn_subr\*.dll %SVN_PACKAGE_PATH%\bin
copy Release\subversion\libsvn_wc\*.dll %SVN_PACKAGE_PATH%\bin
copy Release\subversion\mod_authz_svn\*.so %SVN_PACKAGE_PATH%\modules
copy Release\subversion\mod_dav_svn\*.so %SVN_PACKAGE_PATH%\modules
copy Release\subversion\svn\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\subversion\svnadmin\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\subversion\svndumpfilter\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\subversion\svnlook\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\subversion\svnrdump\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\subversion\svnserve\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\subversion\svnsync\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\subversion\svnversion\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\subversion\svnmucc\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\tools\client-side\svnmucc\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\tools\dev\svnraisetreeconflict\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\tools\diff\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\tools\server-side\*.exe %SVN_PACKAGE_PATH%\bin
copy Release\tools\server-side\mod_dontdothat\*.so %SVN_PACKAGE_PATH%\modules
copy doc\user\*.* %SVN_PACKAGE_PATH%\doc
xcopy /E tools %SVN_PACKAGE_PATH%\tools\
Pause