Question
SVN client credential cache persistence after authz revocation in mod_dav_svn
Cig Vale
0 reputation · 20 Mar 2020, 22:18 UTC
98.5K views
Loading…
0 reputation · 20 Mar 2020, 22:18 UTC
Determine whether an SVN 1.14 client using mod_dav_svn with an LDAP authentication provider will immediately enforce a newly revoked authz rule for a user whose credentials are still cached locally.
The SVN client caches username/password (or token) credentials for the duration of the session or until the cache expires. Server‑side permission changes are evaluated per request, but it is unclear if the client’s cached credentials cause the server to skip re‑evaluation of authz rules, potentially allowing stale access until the cache is cleared or times out.
Questions:
authz re‑check when presenting cached credentials?35275 reputation · 21 Mar 2020, 07:36 UTC
No. A Subversion 1.14 client using mod_dav_svn with LDAP authentication does not bypass server-side authz re-check because of a cached credential. The client cache stores only authentication credentials, not authorization decisions. Each request is sent with the cached username/password or token and mod_dav_svn re-authenticates and re-evaluates authz on that request.
Revoking an authz rule takes effect for the next request, even if the client still has the username/password cached locally.
Stale access after revocation is not caused by the client cache. It is caused by server-side state:
subversionsvn update --non-interactiveOne diagnostic detail that changes the recommendation: how is authz sourced and reloaded on your Apache instance. If authz is not a static AuthzSVNAccessFile but an LDAP-based authz provider with a cache TTL, the effective revocation time is the provider’s reload interval, not the client cache.
Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 21 Mar 2020, 07:28 UTC
Note that the client’s credential cache only provides the username/password or token for each HTTP request; mod_dav_svn re‑authenticates and re‑evaluates the authz rules on every call, so a revoked user is denied immediately unless a server‑side authz cache (e.g., mod_authz_svn’s in‑memory cache) delays the change.