I was looking for this information recently, and thought I'd share what I've found. It is possible to allow anonymous access when using SASL for authentication, but you should be aware that any anonymous access will not be encrypted or integrity protected.
You already have anon-access = read
in svnserve.conf
, as required.
Next, you will have to set min-encryption = 0
, since the anonymous access mechanism supports neither encryption nor integrity protection. Skipping this step would make anonymous access unavailable when authentication mechanisms are negotiated.
The last step is to set your SASL authentication mechanisms, in svn.conf
(your SASL configuration file for Subversion). Change the line:
mech_list: DIGEST-MD5
to
mech_list: DIGEST-MD5 ANONYMOUS
which will make the anonymous mechanism available. Restart svnserve
, and you should be able to perform a check-out with no authentication prompt. If you are using per-directory access control, you may want to confirm that user $anonymous
has been granted the appropriate access.
There are a few things to consider. As mentioned, all access done anonymously will be in clear-text, which you may not want if you are dealing with confidential code over a public network. Also, all users will perform read accesses (check-out, etc.) via anonymous access, so your logs may not be as useful for tracking. Furthermore, if you allow anonymous writes, all code will likely be committed anonymously, meaning you won't know which changes were committed by whom.
As mentioned in the comments, one option is to create an actual user called anonymous, with a simple password (it will fail without a password), and use per-directory access control to make sure only read access is granted, and only to the directories you choose. This allows you to keep encryption/integrity checking, while still offering access that is almost as convenient as true anonymous access.