What is the "enterprise" best practice for SVN security?

Question

(Specifically for VisualSVN.) Should you use SVN authentication or Windows integrated authentication?

Correct if anything here is wrong, but...

The issue with SVN auth is that the administrator basically either has to have the dev come over to type their own password in when their account is created, or they have to create a password for them (so they know the dev's password). But of course, the SVN server admin can access their code anyway because they have full access to the repository itself, so does it matter?

If you're using Windows integrated auth, I believe(?) this means you're giving the devs full access accounts on the SVN server (which I can see anal auditors calling a bad practice depending on what else is running there).

So which type of auth is considered better for a large organization? Does it matter?

Answer 1

Hosting SVN on Apache with DAV (dav_module, dav_svn_module) and AUTHZ (authz_svn_module) and SSPI (sspi_auth_model), means you can validate user-requests against the domain controller. This means everyone with a domain user account can get access, the password policy and reset procedure is already nicely defined (and maintained by someone else), and your admin overhead is really low.

You do still need to define who's in what group, what each group is granted, and what the default access level is, but that's pretty trivial and doesn't involve you knowing their password, just their username.

For example on one of our servers, the default is read access (anyone who can login to the domain can login to the SVN server and view content), while a select group of users (developers) are granted rights to commit/lock/write changes.