Take the 2-minute tour ×

When using Apache2 with client certificates and FakeBasicAuth, how do I refer to users in the AuthzSVNAccessFile? The usernames have funny characters, like /CN=Damon Wischik, and authz doesn't like the = character in usernames.

My Apache configuration has the lines

    SSLVerifyClient require
    SSLOptions +FakeBasicAuth

This means that the user provides a client certificate, Apache takes the subject line from the certificate e.g. /CN=Damon Wischik, and uses that as the username and "password" as the password. I've added an htpasswd entry for this user, and he can log on happily.

Now I want to add fine-grained access control to the repository, and I can't work out how to refer to this username in the AuthzSVNAccessFile. I started off with

* = r

and the user was able to read the contents of the repository. I tried writing

* =
"/CN=Damon Wischik" = r

and the user gets "Access forbidden", and the Apache error log says

[date] [error] [client ip] Failed to load the AuthzSVNAccessFile: The character 'D' in rule '"/CN' is not allowed in authz rules
[date] [error] [client ip] Access denied: '/CN=Damon Wischik' GET foo:/

What's the correct way to escape these funny characters in usernames, in the authz file?

share|improve this question
This isn't my area of expertise, but generally speaking you'd escape a character by using a backslash before the character. –  Jenny D Oct 8 '12 at 7:03
If I try username /CN\=Damon Wischik, I get the error message: "The character 'D' in rule '/CN\\' is not allowed in authz rules" –  DamonJW Oct 8 '12 at 7:42

1 Answer 1

(Thanks to Stefan Sperling on the subversion-users mailing list for the answer.) RTFM! From the red bean book chapter 6,

Subversion 1.5 brought several useful features to the access file syntax—username aliases, authentication class tokens, and a new rule exclusion mechanism—all of which further simplify the maintenance of the access file.

Here is how to use aliases in this particular case.

djw = /CN=Damon Wischik

* = 
&djw = r
share|improve this answer

Your Answer


