Is there any possibility to get group autorisation within subversion authz file?

Question

as far as I understand groups must be defined within subversion authz file. But is there any possibility to define ldap groups within authz file?

I have man svn repositories and each repo has it's authz file. Me and some admins are using a trac plugin to manage access to these repos for instance:

[groups]
dev = persona, personb, personc, persond
buildmanager = persone
doc_writer = personf
reader = personx

[/]
@dev = rw

[/doc]
@doc_writer = rw

and so on.

Now what I want is something like this:

[/]
@ldap_group_1 = rw

Is there any possibility to get this?

Answer 1

Preface

Using SVNPath instead of SVNParentPath for a big set of repositories and, thus, separated administration and management isn't good idea (from my POV). With SVNParentPath you can have unified Apache configuration for any amount (dynamically changing) of repositories per server and single (easier manageable) authz file.

In case of LDAP-backend I can see only one reason for separation configurations for different repos - at auth stage auth_ldap uses property "user belong to special, unique for this repository, group" as authentication condition (see AuthLDAPURL and Require possibilities in Apache's docs). In case of using belonging to different groups later, at authorization for accessing parts of repo, monolitic configuration and authz-file seems more attractive and reliable

Face

1. Yes, groups can be defined inside authz file
2. No, interoperability of authz-groups with any other external authorization sources is not supported (now)
3. You can (and have really) create and support link between LDAP- and authz-groups by hand
4. Good news - such tool already was created and published as LDAP Groups to Subversion Authz Groups Bridge
5. I answered on partially similar question slightly more deeply some time ago