Active Directory and Subversion - Fixing the case-sensitive username problem

If you are running Subversion under Apache HTTPD and you are using the basic ldap provider to connect to Active Directory, then you know that Active Directory will let you authenticate using any case as long as the password matches. Normally this would not be a problem, as most of the time people do not add capitalization to their login names. Where this becomes a problem is when your using an "sn authz" file, which is case-sensitive.

joe.user = rw

this will not match if he logs in with "Joe.User". I became tired of telling people to use only lower-case that I decided to fix the problem for good. I had two possible solutions, patch Subversion or Make a custom authentication provider for Apache. The Apache route sounded easier and not prone to breaking next Subversion update. I already had mod_perl installed so it was quite easy to setup using Apache::AuthenHook.

So first thing you need to do is create a lib folder somewhere to hold your basic provider pm file. I have a pretty organized subversion setup so i just created lib folder in my subversion root.

[jfried@svn01]:/> cat /infrastructure/source/lib/Fried/LDAPProvider.pm
package Fried::LDAPProvider;
use Net::LDAP;
use Apache2::RequestRec;
use Apache2::Const -compile => qw(OK DECLINED HTTP_UNAUTHORIZED);
use strict;

sub handler {
    my ($r, $user, $password) = @_;
    my $ldap = Net::LDAP->new ('ldaps://DOMAIN') 
                                       or return Apache2::Const::DECLINED;
    my $mesg = $ldap->bind("$user@DOMAIN", password => $password );
    $mesg->code && return Apache2::Const::DECLINED;
    if ($mesg->{resultCode} == 0) {
        $r->user(lc $user);
        return Apache2::Const::OK;
    }
    $ldap->unbind;

    return Apache2::Const::DECLINED;
}
1;

Just Update DOMAIN with your Active Directory Domain name. The important part that fixes the problem is the $r->user(lc $user) which tells Apache what the user name should be.

Now to make Apache make use of this we put the following inside our Apache configuration. Inside your subversion virtual host.

PerlSwitches -I/infrastructure/source/lib
PerlLoadModule Apache::AuthenHook


    DAV svn
    SVNParentPath /infrastructure/source/repos
    ...
    AuthType Basic
    AuthBasicProvider Fried::LDAPProvider
    AuthName "Subversion Repositories"
    Require valid-user
    ...

Reload and authz works no mater what case they login with.

Ubuntu Live USB

Well Its Programming Contest time at the Hattiesburg Development Center a yearly recruiting event to attract students from the surrounding universities. Unlike the ACM Contest we give good prizes like game consoles. In past years we used a knoppix based CD image for the contests machines, last year we had some issues with hardware support. The knoppix image was three years old, so I volunteered to setup a new image this year. Seeing how remastering CD images and burning 20 something CDR's is not fun at all or easy I trashed the entire boot CD idea in favor of USB flash drives.

Ubuntu has become very popular in recent years and I have heard good things (RedHat Family Man myself). So I grabbed the latest version and installed it on a Dell tower scavenged from an empty cube. It turns out that Ubuntu comes with a built in tool to create Live USB's it is called "usb-creator". It is very simple to use and it sets up the persistence for you.

Using the Live USB method the contestants can keep work saved threw system crashes and at the end of the contest they can take the entire contest environment home with them. Which i think is a little added value.

Contest Image Setup

So I boot up my new live USB ran an "apt-get upgrade" to bringe it upto date.

Installed the standard packages to support the 3 allowed submission languages: Java, C, C++, More if you can wrap them inside those 3 languages :)

SUN JDK
JAVADOC
GNU G++

To be nice to the contestants I gave them an IDE and a code friendly editor. Though in a contest an IDE will mostly slow you down.

Eclipse
Komodo Edit

User Accounts

I created three user accounts: Judge, Contest and Practice. The first obviously for the three judges to use for judging submissions. The practice user will be used for the practice round before the contest, to allow the team to get comfortable with the contest environment before contest start. And the contest user is for the actual contest, and we will make the password available in the problem statement packet .

I created links to the JAVA Docs and to Eclipse and Komodo Edit and placed them on the desktop of both the contest and practice user. Also copied in friedscript to make the console friendly.

One of the requirements it that the machines have to be cleaned out between the practice round and contest to prevent any work carried over. This is pretty simple as well, I created a tar.gz of the practice home directory and placed a few lines in /etc/rc.local to make sure its clean every time the machine boots. Also /tmp clears out automatically.

cd /home
rm -rf practice
tar -zxf practice.tar.gz

I can send runners around after the practice round to power cycle all the laptops.

Judge Test Harness

I created a test harness using Perl that takes three arguments the command to run the input file to pass it and the expected output file, also a fourth argument triggering debug output. The script runs the command in one thread and monitors its run time in another, if its run time extends past a set limit the command is killed and a "fail" message is sent to the judge. If the command does execute in time and produces output it is automaticly checked against the expected output using diff. The debug switch will show the judges the diff output. But if no difference between the actual output and expected output then a "Passed" message is displayed.

Boot Splash Screen Timeout

If i had more time to work on this project, I could edit the syslinux boot screen to make more sense. But I do not so I just opened up the /cdrom/syslinux/syslinux.cfg and set the timeout to 1. This will cause ubuntu to boot immediately instead of asking you if you want to install.

Final Changes

The guys working on the contest problems will be sending me the example input and output so that I can place them in a folder on the Contest users desktop. This is to prevent any confusion over white space characters on printed examples.

Also set the firefox homepage to the contest submission web site.

Mass Replication

I have been using the Unix 'dd' command to make images of my master usb flash disk for safekeeping. Its also an easy process. /dev/sdb is the USB device

dd if=/dev/sdb of=contest.img bs=64K

So my wife has a 7 port powered USB hub so I think I am going to barrow that combined with the 6 USB ports on my dell with the mouse and keyboard removed (I'll be using SSH). I can image 12 thumb disks at a time :) It will look something like this

dd if=contest.img bs=64K | tee /dev/sdb | tee /dev/sbc | ... > /dev/sdm

That should be interesting it will most likely push the USB bus to a slow crawl, but I am going to try it. I'll update this entry with my results.

(Updated) That does not work so well, the usb's produced had invalid partition tables, and only booted on my dell.

The Annual Deloitte Hattiesburg Development Center Programming Contest will take place on 4/17/2010. So we will see how successful my little image is then.

JasonFried.info