Feature overview

General behaviour

• This feature is activated project by project (for progressive deployment)
• Once activated for a project, by default, nothing should change for subversion users, they can still use their default authentication (DB, ldap, modperl)
• But when they got a token (see after) they can use the token in addition to their default credential

For the user

• In user preferences, users can generate a new token for SVN use. They can generate as many token as needed
• For each token, the owner can
  • See the date of generation
  • See the date of last usage
  • See from which IP it was used
  • Revoke the given token
  • Note: as the token is stored hashed in DB, there is no way to display the token after the generation
  • User can add a short description to the token for futur reference (for instance to know which token to invalidate). Default placeholder is "Token generated at <date> for <purpose>"
• Users can see in which project they can use this token (needed for progressive deployment)
  • As the list of project can be long, limit to projects the user is member of or member of a user group
  • Note: on a given project one can see if the project accept Token in addition to std authentication
• There is also an inline help on how to use this token
• There is an entry in Tuleap Documentation to explain the feature behaviour.

For the project

• On project subversion service, users can see that project accept token in addition to std authentication

For site admin

• Site admin manage the list of projects that are authorized to use token based authentication.
• This have an effect on codendi_svnroot.conf generation (ie. modperl instead of default mode)
• Note: this progressive deployment is only possible when svn authentication is either modmysql or ldap. When site already use modperl, the token support will come "straight".

For SVN usage

• It's still basic auth authentication with username + token (instead of username + password).

Technical concerns

• Token should be treated as password, this means that they are stored properly hashed in DB.