Windows authentication, repository on a Linux server

There are at least two ways to make a Subversion server running on Linux perform authentication through a Windows domain. Either use PAM (Pluggable Authentication Modules) or one of the various authentication modules for Apache. PAM authentication also works for Apache, and is thus a more general solution.

If you wish to use the Apache-only solution, you will need to find an appropriate authentication module. This could for example be:

  • mod_auth_kerb for authenticating against Windows 2000, XP and 2003 domains
  • mod_auth_nt_lm for authenticating against Windows NT4 domains
  • mod_auth_samba or mod_auth_smb for authenticating using older versions of Samba

Note that of the above, only mod_auth_kerb seems to be actively maintained.

Unless you feel that it is too complicated to setup, or that the particular authentication module you are looking for only exists for Apache, you will probably want to use PAM.

In order to use the PAM solution, you will first need to:

  • Install Samba version 3 (or later)
  • Configure Samba's winbind
  • Adjust your system's PAM configuration through /etc/pam.d to allow winbind authentication for the services you wish to use

When you have set up the above appropriately, tunneled svnserve connections (svn+ssh://, svn+rsh:// and similar) should work out-of-the-box, since the ssh daemon and similar tools already per default uses PAM to authenticate users.

To get Apache to work with PAM, make sure that mod_auth_pam is installed and then configure Apache as appropriate.

And of course: This is actually a server question which has little to do with the TortoiseSVN client, and thus further information should be sought on the Subversion FAQ or the Subversion mailing list.