I was recently setting up a development environment with the intent of using Bugzilla and Subversion (via WebDAV).

I needed to create/maintain user accounts for these systems, which was easy enough in Bugzilla, since it has a user maintenance front end.   Subversion uses Apache's authentication mechanism, which meant running "htpasswd" to create each user along with their password.

But I had some issues with this configuration:

1. Ideally, I didn't want users to have to remember two passwords for Bugzilla and Subversion.  But the problem is that users maintain their own password in Bugzilla via the web interface.  Once they change it, Bugzilla and Subversion passwords are out of sync.
2. If a user wanted to change their Subversion password they would have to tell it to me so I could change it via htpasswd.  For liability reasons, I don't want to know the user's password.  I want them to be able to change it on their own, but I also don't want to give them access to the htpasswd file.

A quick and easy solution was to configure Apache to use the Bugzilla user table (stored in MySQL) to authenticate users.  This can be done using the Apache module "mod_auth_mysql".

Bugzilla stores user data on a table called "profiles".  The user id is stored in a column called "login_name", and the password is stored in a column called "cryptpassword".   The password is encrypted using Pearl's "crypt" command (which appears to create a UNIX hashed password).  We don't need to worry about the encryption though; mod_auth_mysql will handle that for us.

The "profiles" table also has a column called "disabledtext".  If this field is not empty, then the user has been disabled (so we probably don't want to allow them access to Subversion). 

The first thing I had to do was get "mod_auth_mysql".  I'm running Fedora Core 4, so I used "yum" to install the package:

> yum install mod_auth_mysql

This automatically created an "auth_mysql.conf" file for me in /etc/httpd/conf.d/ directory.  All this file does is load the module with the line:

LoadModule mysql_auth_module modules/mod_auth_mysql.so

Next, I had to reconfigure my Subversion entry in the httpd.conf file.

In my httpd.conf file I have an entry that looks like this:

#Subversion
<Location "/repos">
  DAV svn
  SVNParentPath /path/to/repo
  AuthzSVNAccessFile /path/to/accessfile
  
  AuthName "SVN Auth"
  AuthType Basic
  
  AuthMySQLUser bz_mysql_user
  AuthMySQLPassword bz_mysql_password
  AuthMySQLDB bugs
  AuthMySQLUserTable profiles
  AuthMySQLNameField login_name
  AuthMySQLPasswordField cryptpassword
  AuthMySQLUserCondition "disabledtext = ''"
  
  require valid-user

</Location>

 You would have to specify your own value for "bz_mysql_user" and "bz_mysql_password" based on the values you used when you configured Bugzilla.

 And that's it.  When your user tries to access the Subversion repository, they will be prompted for their Bugzilla user id (which is their email address, I don't like that so much) and password.

  Warning: If you don't have a Subversion "Access File" in place, than all your Bugzilla users will have write access to the repository.  You probably don't want that.  I have an access file that denies access to all but a configured list of users (actually 2 lists: a read list and a read/write list). After I create a user in Bugzilla, I still have one extra step of adding that user's ID to the access file, assuming I want them to have access Subversion.