完成了openldap的配置之后，为了更进一步的进行用户统一身份认证，所以需要配置SVN使用openldap进行认证，这样的话只需要维护ldap中的用户数据，然后在SVN上进行服务授权即可完成SVN的用户权限分配。同样的，这个配置也适合于其他的软件，比如vsftpd,ssh,openvpn等，下面开始配置SVN使用ldap认证。
1、安装sasl
SASL全称Simple Authentication and Security Layer，是一种用来扩充C/S模式验证能力的机制。
SASL是一个胶合库，通过这个库把应用层与形式多样的认证系统整合在一起。这有点类似于PAM，但是后者是认证方式，决定什么人可以访问什么服务，而SASL是认证过程，侧重于信任建立过程，这个过程可以调用PAM来建立信任关系。在这里Memcached就是上面提到的应用层，具体的认证交给SASL库，SASL会根据相应的认证机制来完成验证功能。
yum -y install *sasl* -y
[[email protected] conf]# rpm -qa|grep sasl
saslwrapper-0.14-1.el6.x86_64
cyrus-sasl-devel-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-md5-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-lib-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-sql-2.1.23-15.el6_6.2.x86_64
python-saslwrapper-0.14-1.el6.x86_64
cyrus-sasl-ntlm-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-gssapi-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-plain-2.1.23-15.el6_6.2.x86_64
ruby-saslwrapper-0.14-1.el6.x86_64
saslwrapper-devel-0.14-1.el6.x86_64
cyrus-sasl-ldap-2.1.23-15.el6_6.2.x86_64
2、配置sasl使用ldap认证
[[email protected] ~]# grep "^MECH" /etc/sysconfig/saslauthd
MECH=pam
[[email protected] ~]# sed -i ‘/MECH/s/pam/ldap/‘ /etc/sysconfig/saslauthd
[[email protected] ~]# grep "^MECH" /etc/sysconfig/saslauthd
MECH=ldap
[[email protected] ~]# cat >> /etc/saslauthd.conf
ldap_servers: ldap://192.168.49.138/
ldap_bind_dn: cn=admin,dc=contoso,dc=com
ldap_bind_pw: 123456
ldap_search_base: ou=People,dc=contoso,dc=com
ldap_filter: uid=%U
ldap_password_attr: userPassword
[[email protected] ~]# cat /etc/saslauthd.conf
ldap_servers: ldap://192.168.49.138/
ldap_bind_dn: cn=admin,dc=contoso,dc=com
ldap_bind_pw: 123456
ldap_search_base: ou=People,dc=contoso,dc=com
ldap_filter: uid=%U
ldap_password_attr: userPassword
[[email protected] ~]# /etc/init.d/saslauthd restart
Stopping saslauthd: [FAILED]
Starting saslauthd: [ OK ]
3、testsaslauthd测试ldap账号能否通过认证
[[email protected] ~]# useradd test01
[[email protected] ~]# echo "123456" |passwd --stdin test01
Changing password for user test01.
passwd: all authentication tokens updated successfully.
[[email protected] ~]# testsaslauthd -utest01 -p123456
0: NO "authentication failed"
[[email protected] ~]# testsaslauthd -ucharleslv -p123456
0: OK "Success."
[[email protected] ~]# testsaslauthd -uericli -p123456
0: OK "Success."
[[email protected] ~]# testsaslauthd -uzhangs -p123456
0: OK "Success."
成功的结果是本地账户无法认证成功，ldap用户认证成功。
4、配置svn使用saslauthd进行认证
[[email protected] ~]# cat >>/etc/sasl2/svn.conf
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN
[[email protected]inux ~]# cat /etc/sasl2/svn.conf
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN
[[email protected] ~]# /etc/init.d/saslauthd restart
Stopping saslauthd: [ OK ]
Starting saslauthd:
5、配置SVN数据仓库使用sasl认证
[[email protected] ~]# cd /opt/svndata/idc/conf/
[[email protected] conf]# cp svnserve.conf svnserve.conf.bak$(date +%F)
[[email protected] conf]# grep use-sasl svnserve.conf
# use-sasl = true
[[email protected] conf]# sed -i ‘/use-sasl/s/^# //‘ svnserve.conf
[[email protected] conf]# grep use-sasl svnserve.conf
use-sasl = true
#重启svn服务
[[email protected] conf]# ps -ef |grep svn
root 1075 1 0 23:26 ? 00:00:00 svnserve -d -r /opt/svndata/
root 1235 1039 0 23:56 pts/0 00:00:00 grep svn
[[email protected] conf]# pkill svnserve
[[email protected] conf]# ps -ef |grep svn
root 1238 1039 0 23:56 pts/0 00:00:00 grep svn
[[email protected] conf]# /root/svn.sh start
SVN server started successful.
[[email protected] conf]# ps -ef|grep svn
root 1244 1 0 23:57 ? 00:00:00 svnserve -d -r /opt/svndata/
root 1249 1039 0 23:57 pts/0 00:00:00 grep svn
[[email protected] conf]# lsof -i :3690
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
svnserve 1244 root 3u IPv4 21252 0t0 TCP *:svn (LISTEN)
6、修改认证文件authz，对ldap进行授权
[[email protected] conf]# vi /opt/svnpasswd/authz #这里我的authz修改了配置，所以不在repository/conf目录下
[[email protected] conf]# tail -6 /opt/svnpasswd/authz
[idc:/]
test01 = rw
test02 = r
charleslv = rw
ericli = r
zhangs = rw
#使用我的脚本重启svn服务
[[email protected] conf]# /root/svn.sh restart
SVN server stopped successful.
SVN server started successful.
7、使用ldap用户进行svn操作
[[email protected] conf]# svn checkout svn://192.168.49.129/idc /tmp --username=charleslv --password=123456
A /tmp/b.txt
A /tmp/access.log
A /tmp/hello.txt
A /tmp/新建文本文档.txt
A /tmp/testf.txt
A /tmp/xm01.txt
A /tmp/check.sh
A /tmp/branch
A /tmp/branch/b.txt
A /tmp/branch/access.log
A /tmp/branch/hello.txt
A /tmp/branch/新建文本文档.txt
A /tmp/branch/testf.txt
A /tmp/branch/xm01.txt
A /tmp/branch/check.sh
A /tmp/branch/testfile.txt
A /tmp/branch/a.txt
A /tmp/test_ldap.txt
A /tmp/testfile.txt
A /tmp/a.txt
Checked out revision 25.
再到windows客户端测试一下
输入用户名zhangs和密码
更新成功，说明SVN已经可以使用ldap进行认证了，到此，配置svn使用ldap认证的操作成功。