Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can I setup Mercurial to authenticate users on Active Directory? In my case, hg can run on Windows, Linux or FreeBSD, but I need to use AD users.

Note: if it is possible, then please point me to a tutorial.

share|improve this question
up vote 11 down vote accepted

Well, I started with this tutorial.

After I've finished that I made the following additional changes on the server (Windows 2008):

  • Configured IIS to use SSL;
  • Disabled anonymous authentication for the site;
  • Enabled Basic and Windows authentication for the site;
  • Configured NTFS permissions on the repository folder.

Also need to add the following lines to your repository's .hg\hgrc file:

On the client-side I had to explicitly specify username and password.

allow_push = *
share|improve this answer
+1 for the guide – Richard Slater Mar 20 '10 at 11:11

If you're looking for some intergrated system that can work on windows, unix, and authenticate to AD try out RhodeCode It's kind of local instance of bitbucket that serves repositories. It comes with permission system and easy user management.

share|improve this answer
Yay for RhodeCode! :-) – Martin Geisler Dec 25 '11 at 0:09

I wrote a 4 part blog post a couple of months back that allows you to use Active Directory/IIS to host Mercurial's web server. It works a treat:

It walks you through:

  • Set up of Mercurial within IIS
  • Configuring the ISAPI extensions for Python
  • ISAPI rewrite to hide ugly URLs
  • Configuration of security privileges using Active Directory
  • Customization of the web UI
share|improve this answer
+1, great blog post(s). We're piloting Mercurial for both our Windows and Linux projects. Any chances you'll be updating this guide for IIS 7.5? – jscott Mar 22 '12 at 13:34
I will be once I get around to upgrading my server. – BenAlabaster Mar 22 '12 at 18:03

Ben already gave you a good guide for setting up Mercurial on IIS with AD.

I would just like to add, that the key thing you need to know is that the built-in (Fast)CGI script in Mercurial does not authenticate users. The CGI script we supply relies on a front-end webserver to do the authentication. So you must setup Apache, IIS, nginx, ... to do authentication before they invoke the script. (However, you can use the excellent RhodeCode if you want a Bitbucket-like system with LDAP support that you can hook up to AD too.)

This separation of concerns makes Mercurial very flexible: if you want Active Directory authentication, then you just use the standard plugin for your webserver to do that. Many sites will already have this setup and so Mercurial will "just work" :-)

So Mercurial never checks any passwords — the authentication part. But it can do authorization, meaning that it can allow or forbid users from pushing or pulling, etc. This is done based on the username stored in the standard REMOTE_USER CGI variable. It is up to the webserver to set this variable after it has authenticated the remote user.

In Mercurial, the username is matched against the allow_push and allow_read lists in the [web] section to determine if the user is allowed to push or pull/clone the repository in question. This can of course be configured on a per-repository basis by editing the .hg\hgrc files in each repository.

share|improve this answer

Excuse my necroposting, but I've just released an alpha version of HgLab, which is a Mercurial Server for Windows and it supports Active Directory authentication out of the box.

share|improve this answer
Please read our faq in particular May I promote products or websites I am affiliated with here?. – Iain Jan 10 '13 at 10:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.