Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am evaluating the possibilities of moving my organisation to Mercurial, however I am stumbling on two basic requirements which I can't find proper pointers to.

How do I set up Mercurial's central repository to authenticate users with the central Active Directory and only allow them to push or pull if they have the right credentials?

How do I set up a Mercurial project repository to only allow users pertaining to a specific group to push/pull source code? We need this to have per-project authorisation.

On which HTTP servers (IIS or Apache etc.) are the above two requirements supported?

Apologies if I am asking something obvious or if I am missing something fundamental about how authentication and authorisation works.

share|improve this question
Duplicate of:… – Martin Geisler Dec 22 '11 at 23:17

2 Answers 2

I did a four part blog post for set up of Mercurial on IIS with Active Directory authentication and using hgwebdir.cgi for push authorization. It goes over the whole process of:

  • Setting up Mercurial's hg web interface on IIS.
  • Setting up the IIS authentication for Mercurial so that only users authorized by the active directory (i.e. security groups/users) can view/access the repositories either via the hg web interface or through the file system.
  • Configuring Active Directory authentication for Mercurial users, so only authorized users can see/access the repositories they have access to.
  • Configuring hgwebdir.cgi via hgweb.config to set push authorization for specified users to repositories.
  • Hiding hgwebdir.cgi using Helicon's ISAPI Rewrite in your repository's URL.
  • Customizing the style/feel of the hg web user interface to your own taste.

I hope it's useful to people...

share|improve this answer

You can do it with Apache. Check how to restrict pushing in Apache at:

Seem above on the same file on how to configure mercurial, its permissions and all users allowed by Apache.

After you've setup mercurial and Apache, you can use mod_authnz_ldap to only allow access to Active Directory users:

Don't forget to check the paragraph on Active Directory configuration.

That should be enough for you.

Best of luck,
João Miguel Neves

share|improve this answer
Using authnz_ldap transmits passwords unencrypted between the client and Apache. I'm trying to find out how to avoid that, but not having a lot of luck. – LeBleu Jan 30 at 21:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.