注册 登录  
 加关注
   显示下一条  |  关闭
温馨提示!由于新浪微博认证机制调整,您的新浪微博帐号绑定已过期,请重新绑定!立即重新绑定新浪微博》  |  关闭

骐骥一跃

日积跬步 业精于勤荒于嬉

 
 
 

日志

 
 

[原创] Windows下通过MySQL认证Subversion  

2007-12-27 09:53:15|  分类: Subversion |  标签: |举报 |字号 订阅

  下载LOFTER 我的照片书  |

原创作品,允许转载,转载时请务必以超链接形式标明文章 原始出处 、作者信息和本声明。否则将追究法律责任。
引用地址:http://indian.blog.163.com/blog/static/10881582007112795315366/

作者:indian

版本:v1.0

修订:2012年11月14日17:02:54

出处:http://indian.blog.163.com/blog/static/10881582007112795315366/

版权:作者保留对本文的一切修改、发布等权力。任何人想要转载本文部分或全部内容时,必须保留包括作者、版本、修订、出处、版权,共五项信息。对本文的参考引用,则不受限制。

勘正:如有缪误的地方,包括错别字,请联系我修订。Email:indian@163.com

 

关键词:

 


 

环境:

OS:Windows XP SP2
  Apache:2.2.6
  Subversion:1.4.6

 

一般情况下,subversion的用户密码文件是以文本文件形式存放在文件系统中的。出于安全性的需要或者单点登陆等可扩展性的考虑,文本文件的管理方式都不能满足需求了。通过 Apache 的 module_auth_mysql 模块,我们可以用 MySQL 来保存用户信息。该模块的主页在 http://modauthmysql.sourceforge.net/,你也可以在 http://modules.apache.org/ 找到它的发行版本。安装方法同其它 Apache 的模块一样,拷贝至 modules 目录并在 httpd.conf 文件中添加如下语句:

LoadModule mysql_auth_module modules/mod_auth_mysql.so

相应的 Location 区域改写为:

<Location /repos/>
 AuthName "MySQL Testing"
 AuthType Basic
 AuthMySQLHost db.kysf.net
 AuthMySQLUser svnadmin
 AuthMySQLPassword PaSsWoRd    #必填项
 AuthMySQLDB svn
 AuthMySQLUserTable users
 AuthMySQLNameField user_name
 AuthMySQLPasswordField user_password
 AuthMySQLGroupField user_group
 AuthMySQLPwEncryption none    #必填项
 require valid-user
</Location>

其中,

AuthMySQLHost db.kysf.net
  AuthMySQLUser svnadmin
  AuthMySQLDB svn
  AuthMySQLUserTable users
  AuthMySQLNameField user_name
  AuthMySQLPasswordField user_password
  AuthMySQLGroupField user_group

这6项可以省略。如果省略系统采用默认的值,其默认值如下:

默认值:

AuthMySQLHost localhost
  AuthMySQLUser ODBC
  AuthMySQLDB test
  AuthMySQLUserTable user_info
  AuthMySQLNameField user_name
  AuthMySQLPasswordField user_password
  AuthMySQLGroupField user_group

然后在 mysql 中添加名为 svn 的数据库,并建立 users 数据表:

create database svn;
use svn;
CREATE TABLE users (
 user_name CHAR(30) NOT NULL,
 user_password CHAR(20) NOT NULL,
 user_group CHAR(10),
 PRIMARY KEY (user_name)
);

在 users 表中插入用户信息

insert into users values('username','password','group');

重新启动 Apache,在访问版本库的时候 Apache 就会用 mysql 数据表中的用户信息来验证了。

 

====================================================================================================================================

 

所有的 mod_auth_mysql 模块的配置选项如下:

AuthMySQLEnable On
AuthMySQLHost <default -- localhost>
AuthMySQLPort <default port in MySQL>
AuthMySQLSocket <default socket in MySQL>
AuthMySQLUser <default -- ODBC>
AuthMySQLPassword <no default -- NULL>
AuthMySQLDB <default -- test>
AuthMySQLUserTable user_info
AuthMySQLUserCondition <no default>
AuthMySQLNameField <default -- user_name>
AuthMySQLPasswordField <default -- user_password>
AuthMySQLNoPasswd Off
AuthMySQLPwEncryption crypt
AuthMySQLSaltField <>
AuthMySQLGroupTable <defaults to value of AuthMySQLUserTable>
AuthMySQLGroupCondition <no default>
AuthMySQLGroupField <no default>
AuthMySQLKeepAlive Off
AuthMySQLAuthoritative On
AuthMySQLCharacterSet <no default>

 

说明:

AuthMySQLEnable On | Off
Whether or not mod_auth_mysql should attempt to authorize the user.
Off: No authorization will be done by this module. (不由 mod_auth_mysql 模块认证,由 UserFile 认证或其它方式认证。)
On: Attempt to authorize the user. (让 mod_auth_mysql 模块管理认证。)

AuthMySQLHost localhost | host_name_or_ip_address
Identifies the MySQL host.

AuthMySQLPort tcp/ip_port_number
The tcp/ip port which should be used to access MySQL. MySQL normally uses port 3306, but this can be changed in the MySQL configuration. See the MySQL documentation for more details.

AuthMySQLSocket full_path_to_socket_file
The UNIX socket which should be used to access MySQL host "localhost" on a UNIX system. The default is /tmp/mysql.sock, but this can be changed in the MySQL configuration. See the mySQL documentation for more details.

AuthMySQLUser userid
The userid to be used to access MySQL. This user must have SELECT access to the appropriate tables. As the password must be in plain text (see AuthMySQLPassword below), it is recommended you use a userid with limited privileges (do NOT use "root"!).

AuthMySQLPassword password
The password for the userid specified in AuthMySQLUser. An, as the password must be in plain text, it is recommended you use a userid with limited
privileges (do NOT use "root"!).

AuthMySQLDB database_name
The name of the MySQL database containing the authorization information. On systems with case sensitive file systems (i.e. Unix), this field is case
sensitive.

AuthMySQLUserTable mysql_table_name
The name of the MySQL table in AuthMySQLDB which contains the userids and passwords. On systems with case sensitive file systems (i.e. Unix), this field is case sensitive.

If this field contains two or more table names, you will need to join the tables in the AuthMySQLUserCondition (below).

AuthMySQLUserCondition condition
Additional conditions to be placed in the WHERE clause when retrieving user information. Whatever is in this string is appended after an AND condition in the SQL statement.

If two or more tables have been specified in the AuthMySQLUserTable option above, this option must contain the information required to join the tables.

AuthMySQLNameField mysql_column_name
The name of the column in AuthMySQLUserTable which contains the userids to be authenticated. The column must contain unique, non-empty field values. Its length is however long you want it to be. This value is case sensitive.

Values in this field are case sensitive ONLY if you define the column as binary data (i.e. BINARY, VARBINARY, etc.). It is NOT case sensitive if the column is defined with character data (i.e. CHAR, VARCHAR). See the MySQL documentation for more information.

AuthMySQLPasswordField mysql_column_name
The name of the column in AuthMySQLUserTable which contains the passwords. This value is case sensitive. It's length may be as long as you want it to be for plaintext passwords. If the password is encrypted, the field must be long enough to contain the encrypted data. See AuthMySQLPwEncryption below.

Passwords values are case sensitive.

AuthMySQLNoPasswd Off
No password is required for this resource.

AuthMySQLPwEncryption none | crypt | scrambled | md5 | aes | sha1
The encryption type used for the passwords in AuthMySQLPasswordField:
none: not encrypted (plain text)
crypt: UNIX crypt() encryption
scrambled: MySQL PASSWORD encryption
md5: MD5 hashing
aes: Advanced Encryption Standard (AES) encryption
sha1: Secure Hash Algorihm (SHA1)
密码加密方式。数据库中可以并存多种加密的密码。如果数据库中密码是以这种方式加密的,密码被放行;非此种方式加密的密码不允许通过。此指令为必填项。

WARNING: When using aes encryption, the password field MUST be a BLOB type (i.e. TINYBLOB). MySQL will strip trailing x'20' characters (blanks), EVEN IF THE COLUMN TYPE IS BINARY!

AuthMySQLSaltField <> | <string> | mysql_column_name
Contains information on the salt field to be used for crypt and aes encryption methods. It can contain one of the following:
<>: password itself is the salt field (use with crypt() only)
<string>: "string" as the salt field mysql_column_name: the salt is take from the mysql_column_name field in the same row as the password

This field is required for aes encryption, optional for crypt encryption. It is ignored for all other encryption types.

AuthMySQLGroupTable
Contains the name of the table with the group information when authorizing by groups (Apache option require group).

As with the AuthMySQLUserTable, you can specify two or more tables in this option, in which case you will need to join the tables in the AuthMySQLGroupCondition below.

AuthMySQLGroupCondition condition
Additional conditions to be placed in the WHERE clause when retrieving group information. Whatever is in this string is appended after an AND condition in the SQL statement.

If two or more tables have been specified in the AuthMySQLGroupTable option above, this option must contain the information required to join the tables.

AuthMySQLGroupField
This option contains the name of the column containing the group information when Apache group authorization is required. Values in the Apache require group option will be matched against the retrieved rows.

AuthMySQLKeepAlive On | Off
Indicates whether to keep the connection to MySQL open or close it after each request. Keeping the connection open can improve performance at the cost of the resources necessary to maintain the connection. If this is Off, the connection will be closed after each request.

Currently, only one connection to the server can have AuthMySQLKeepAlive on.

Note: This parameter currently does not work with Apache 2.x and is ignored. We are aware of the bug.

AuthMySQLAuthoritative On | Off
Used to indicate if other modules should be called when mod_auth_mysql is not able to authorize the user. If this is On, no other modules will be called and the request will fail. If this is off, Apache will attempt to use mod_auth and/or any other active modules to authorize the user.

AuthMySQLCharacterSet
Used to override the default characterset for the connection. This parameter must specify a valid character set in MySQL. It is generally required only in MySQL 4.1 and above, where the characterset encoding for the tables being used is different that the default specified in the MySQL configuration.

 

 

Additional Information
======================

AuthMySQLUserCondition and AuthMySQLGroupCondition

The optional directives AuthMySQLUserCondition and AuthMySQLGroupCondition can be used to restrict queries made against the User and Group tables. The value for each of these should be a string that you want added to the end of the where-clause when querying each table. For example, if your user table
has an "active" field and you only want users to be able to login if that field is 1, you could use a directive like this: AuthMySQLUserCondition active=1

You can specify parameters for system options. These parameters will be replaced by the appropriate values in the query. See Formats below.

Groups
A user can be a member of multiple groups, but in this case the user id field *cannot* be PRIMARY KEY. You need to have multiple rows with the same user ID, one per group to which that ID belongs. In this case, you MUST put the GroupTable on a separate table from the user table. This is to help prevent the user table from having inconsistent passwords in it. If each user is only in one group, then the group field can be in the same table as the password field. A group-only table might look like this:

CREATE TABLE user_group (
user_name char(50) DEFAULT '' NOT NULL,
user_group char(20) DEFAULT '' NOT NULL,
create_date int,
expire_date int,
PRIMARY KEY (user_name,user_group)
);

Note that you still need a user table which has the passwords in it.

There are two options to using groups. You can put the "user_group" field into the same table as the user database if each user is in only one group, or you can have a separate table that contains the fields "user_name" and "user_group" if each user is a member of multiple groups.

If the user_group field is part of the full user table, the table has three fields at least: user_name, user_group, user_passwd. The user_group field must be "PRIMARY KEY" in the user database containing a password. The htaccess file would be this:

AuthName My Authorization
AuthType Basic
AuthGroupFile /dev/null # do NOT include this directive if using Apache2!!!
AuthMySQLHost localhost
AuthMySQLDB authdata
AuthMySQLUserTable user_info
AuthMySQLGroupField user_group
require group admin

If you have a separate database for groups, the two tables would be

user_info: user_name, user_passwd (user_name must be PRIMARY KEY)

user_group: user_name, user_group (user is not PRIMARY KEY, as we have multiple tuples for user_name,user_group to let a user be in multiple groups)

and htaccess would have this:

AuthName My Authorzation
AuthType Basic
AuthGroupFile /dev/null # do NOT include this directive if using Apache2!!!
AuthMySQLHost localhost
AuthMySQLDB authdata
AuthMySQLUserTable user_info
AuthMySQLGroupTable my_groups
AuthMySQLGroupField user_group
require group admin

Assuming that the required group name is "admin".

Multiple Tables

If you have user information stored in two (or more) different tables, you can join the tables like this:

AuthName My Authorization
AuthType Basic
AuthGroupFile /dev/null # do NOT include this directive if using Apache2!!!
AuthMySQLHost localhost
AuthMySQLDB test
AuthMySQLUserTable "user_info, user_status"
AuthMySQLUserCondition = "user_info.user_name = user_status.user_name and user_status.status = 'OK'"
require valid-user

 

 

Formats
=======

You can specify the following paramaters in the AuthMySQLUserCondition and AuthMySQLGroupCondition clauses. They will be replaced by the appropriate values in the query.

%h DNS name of the remote host
%a IP address of the remote host
%f The filename being requested
%V Hostname of the Apache server
%v Virtual hostname
%H Protocol sent with the request (i.e. HTTP/0.9)
%m Request method (i.e. GET, HEAD, POST, etc.)
%q Arguments following the ? in the request
%r Request line
%U Path portion of the URI

These parameters can be used to further limit access. For instance, if you wish to limit users to a single ip address, you could add the following column to your user_info table:

ip_address VARCHAR (15)

You could then do something similar to this:

AuthName My Authorization
AuthType Basic
AuthGroupFile /dev/null # do NOT include this directive if using Apache2!!!
AuthMySQLHost localhost
AuthMySQLDB test
AuthMySQLUserTable user_info
AuthMySQLUserCondition = "ip_address = '%a'"
require valid-user

 

示例:集成用户文件(UserFile)认证和MySQL数据库认证

<Location /repos/>
 DAV svn
 SVNListParentPath on
 #SVNPath e:/svn/repos1
 SVNParentPath e:/svn

 AuthzSVNAccessFile E:/usr/Apache2.2/bin/accesspolicy.conf

 Satisfy Any
 Require valid-user

 AuthType Basic
 AuthName "MySQL Auth"

 AuthMySQLEnable on
 AuthMySQLPwEncryption md5
 AuthMySQLAuthoritative off
 AuthMySQLHost localhost
 AuthMySQLUser svnslt
 AuthMySQLPassword list
 AuthMySQLDB svn_auth
 AuthMySQLUserTable users
 AuthMySQLNameField user_name
 AuthMySQLPasswordField user_passwd
 AuthMySQLGroupTable groups
 AuthMySQLGroupField user_group

 AuthUserFile E:/usr/Apache2.2/bin/passwd.conf
</Location>

说明:

既可以用数据库中的用户名认证,也可以用文件中的用户名认证。如果数据库认证失败,就由用户文件认证。不过最好把用户文件和数据库中的用户名设为一致,防止单点失败。

 

 

~全文完~

 

        indian

    2007年12月27日9:02:03

    2008年3月5日14:15:59 更新  添加具体操作步骤

  评论这张
 
阅读(1340)| 评论(0)
推荐

历史上的今天

在LOFTER的更多文章

评论

<#--最新日志,群博日志--> <#--推荐日志--> <#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇,下一篇--> <#-- 热度 --> <#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->
 
 
 
 
 
 
 
 
 
 
 
 
 
 

页脚

网易公司版权所有 ©1997-2018