Can I setup Mercurial to authenticate users on Active Directory? In my case, hg can run on Windows, Linux or FreeBSD, but I need to use AD users.
Note: if it is possible, then please point me to a tutorial.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Well, I started with this tutorial.
After I've finished that I made the following additional changes on the server (Windows 2008):
Also need to add the following lines to your repository's
On the client-side I had to explicitly specify username and password.
[web] allow_push = *
If you're looking for some integrated system that can work on windows, unix, and authenticate to AD/LDAP try out RhodeCode http://rhodecode.com It's kind of local instance of bitbucket/github that serves repositories. It comes with permission system and easy user management, code review etc.
I wrote a 4 part blog post a couple of months back that allows you to use Active Directory/IIS to host Mercurial's web server. It works a treat:
It walks you through:
Ben already gave you a good guide for setting up Mercurial on IIS with AD.
I would just like to add, that the key thing you need to know is that the built-in (Fast)CGI script in Mercurial does not authenticate users. The CGI script we supply relies on a front-end webserver to do the authentication. So you must setup Apache, IIS, nginx, ... to do authentication before they invoke the script. (However, you can use the excellent RhodeCode if you want a Bitbucket-like system with LDAP support that you can hook up to AD too.)
This separation of concerns makes Mercurial very flexible: if you want Active Directory authentication, then you just use the standard plugin for your webserver to do that. Many sites will already have this setup and so Mercurial will "just work" :-)
So Mercurial never checks any passwords — the authentication part. But it can do authorization, meaning that it can allow or forbid users from pushing or pulling, etc. This is done based on the username stored in the standard
REMOTE_USER CGI variable. It is up to the webserver to set this variable after it has authenticated the remote user.
In Mercurial, the username is matched against the
allow_read lists in the
[web] section to determine if the user is allowed to push or pull/clone the repository in question. This can of course be configured on a per-repository basis by editing the
.hg\hgrc files in each repository.
Excuse my necroposting, but I've just released an alpha version of HgLab, which is a Mercurial Server for Windows and it supports Active Directory authentication out of the box.