How would I Add Two "AD" Groups in 1 LDAP Server - authentication

Question

I have installed and configured a subversion in Linux7 and from the front end I am using svn tortoise. From server lever, I want to integrate my subversion with AD.
I have two repositories inside /u01/ciroot/subversion, like DEV_REPO and PROD_REPO.
Also in AD I have two groups; one is OBIEE_DEV and another is OBIEE_PROD. Now I want members of group OBIEE_DEV to access the repository DEV_REPO and members of group OBIEE_PROD
to access the repository DEV_REPO and PROD_REPO (both). So in my AD, under group OBIEE_DEV, I have user1 and user2 both there, but in the AD group OBIEE_PROD I only have user2.
These things are placed properly. But in /etc/httpd/conf.d/subversion.conf file how should I declare this? Below is my subversion.conf file where right now only one group entry is mentioned which is OBIEE_DEV, i want to add entry for group OBIEE_PROD too here. Please guide me how to achieve this.
<pre>
<location /svn>
DAV svn
SVNParentPath /u01/ciroot/subversion
AuthType Basic
AuthBasicProvider ldap
AuthName "Root Repo"
AuthLDAPURL "ldap://ldap.server.com:389/DC=macgroup,DC=local?sAMAccountName?sub?(&(ObjectClass=*)(memberOf=CN=OBIEE_DEV,OU=OBIEE,OU=Security,OU=Groups,OU=Global Resources,DC=MACGROUP,DC=LOCAL))" STARTTLS
AuthLDAPBindDN "CN=oidkerbt,OU=Service Accounts,OU=Users,OU=Global
Resources,DC=macgroup,DC=local"
AuthLDAPBindPassword password_of_ldap_server
Require valid-user
</location>
</pre>

Answer 1

First, read the box titled "Do You Really Need Path-Based Access Control?" here: http://svnbook.red-bean.com/en/1.7/svn.serverconfig.pathbasedauthz.html
But if you still decide you want to do this, that link should help you set this up. But basically, create two location entries: one for each repository. You point each at the group at the AD group that grants that permission.
If you want people in the OBIEE_PROD group to have access to the DEV_REPO too, then just add the OBIEE_PROD group to your OBIEE_DEV group in AD.
This is an example, but I can't guarantee this will work exactly as-is:
<location /svn/DEV_REPO>
DAV svn
SVNParentPath /u01/ciroot/subversion
AuthType Basic
AuthBasicProvider ldap
AuthName "Root Repo"
AuthLDAPURL "ldap://ldap.server.com:389/DC=macgroup,DC=local?sAMAccountName?sub?(&(ObjectClass=*)(memberOf=CN=OBIEE_DEV,OU=OBIEE,OU=Security,OU=Groups,OU=Global Resources,DC=MACGROUP,DC=LOCAL))" STARTTLS
AuthLDAPBindDN "CN=oidkerbt,OU=Service Accounts,OU=Users,OU=Global
Resources,DC=macgroup,DC=local"
AuthLDAPBindPassword password_of_ldap_server
Require valid-user
</location>
<location /svn/PROD_REPO>
DAV svn
SVNParentPath /u01/ciroot/subversion
AuthType Basic
AuthBasicProvider ldap
AuthName "Root Repo"
AuthLDAPURL "ldap://ldap.server.com:389/DC=macgroup,DC=local?sAMAccountName?sub?(&(ObjectClass=*)(memberOf=CN=OBIEE_PROD,OU=OBIEE,OU=Security,OU=Groups,OU=Global Resources,DC=MACGROUP,DC=LOCAL))" STARTTLS
AuthLDAPBindDN "CN=oidkerbt,OU=Service Accounts,OU=Users,OU=Global
Resources,DC=macgroup,DC=local"
AuthLDAPBindPassword password_of_ldap_server
Require valid-user
</location>