[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: On backporting r21531 to 1.4.x.

From: Samay <getafix123_at_hotmail.com>
Date: 2006-10-10 00:22:25 CEST

>> with svn 1.4.x neon0.26.x, it just doesnt work. please refer to thread
>> http://svn.haxx.se/users/archive-2006-09/0950.shtml for a legnthy
>> discussion
>> on how0.25.x Neon works but 0.26.1 doesnt. We resolved this issue by
>> using
>> 1.4.x compiled against 0.25.x of Neon (Thanks DJ Heap). Since TSVN 1.4.x
>> is
>> shipped with Neon 0.25.x it was ok.
> SSPI is working fine with neon 0.26.1 (dynamic options and desired
> auth behavior aside) based on the testing I did (admittedly not
> exhaustive, but quite a bit) and the feedback I've gotten. Isn't your
> problem specific to GSSAPI?

the problem we are seeing with 0.26.x is with server side requesting SPNego
method. SPnego is one of the five possible methods supported by SSPI by
windows on client/server side. For more accurate details please refer to

It is incorrect to say SSPI works fine when the default method
(kerberos/SPnego) doesnt work at all. You may see it working on environemnt
as its probably falling back to NTLM etc. Again SSPI is windows abstraction
API one of which is GSSAPI.

> GSSAPI (related to SSPI but a different auth protocol?) seems to have
> trouble (as in crashes) with 0.26.1 but no one can provide a server to
> test against and setting up a GSSAPI server seems to be rather
> involved.

Best bet would be to setup a few VM environments.

> I'm also fairly sure that the GSSAPI problem is not
> specific to Windows.

its same problem whether using windows or linux clients. On Linux i have
tested it to fail when using MIT-Krb5 1.4.x .. haven't had any resources to
test with Hemidal or MIT-Krb5 1.5.x. Again, problem disappears the moment we
switch to Neon 0.25.5 instead of 0.26.1 on client side :)

> And my understanding is that GSSAPI doesn't work
> at all in neon 0.25.5 -- it just always drops back to BASIC, but I
> haven't tested that myself.

I would say above is incorrect. GSSAPI works well (except for the problems
with larger repo) wih 0.25.5. Server side method is SPNego (mod_auth_kerb)
and K5Passwd set to off. None of our repositories support Basic
authentication ... thats the reason we got bitten by this problem on both
Windows & Linux. So no fall backs to Basic auth in our env.

To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Tue Oct 10 00:22:38 2006

This is an archived mail posted to the Subversion Dev mailing list.