2

I have a Mercurial server using mercurial-server. I edited access.conf in hgadmin repo as follows:

deny repo=a/b
read user=x/**
read user=y/**

write repo=a/b user=x/abc
write repo=a/b user=y/z

But user z still can't access this repo. Any ideas?

Martin Geisler
  • 72,968
  • 25
  • 171
  • 229
Eslam
  • 1,623
  • 2
  • 12
  • 18

3 Answers3

2

The documentation mentions:

user=globpattern: path to the user's key

So the path of z's key might be wrong, or the path of the repo is off.

When considering a request, mercurial-server steps through all the rules in /etc/mercurial-server/access.conf and then all the rules in access.conf in hgadmin, looking for a rule which matches on every condition.
The first match determines whether the request will be allowed; if there is no match in either file, the request will be denied.

Other possibility: Maybe a deny rule (applicable for user z) is found first.

VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
2

The first matching rule applies. In this instance the deny rule is first, so it will match first; no user will be given access to repo a/b no matter what other rules follow this one.

Try placing the two write rules above the deny rule.

Note also that any rules in /etc/mercurial-server/access.conf will logically precede these rules.

Paul Crowley
  • 1,656
  • 1
  • 14
  • 26
  • yeah you are totally right , both /etc/mercurial-server/access.conf and access.conf of hgadmin repo contains conflicting rules that lead to this mess , but i'm facing now a new weird problem i have roles as following: "read repo=a/b user=users/x deny repo=a/b" ==> this lead to user x can't clone this repo another roles : "read repo=a/b user=users/* deny repo=a/b" ==> this lead to user x can clone repo a/b any ideas why this happens – Eslam Feb 02 '12 at 02:05
1

There is one more especiality about mercurial server that you may need to know. That you can not duplicate keys several times in keys/ of hgadmin. Because on server side those keys are compiled into /var/lib/mercurial-server/.ssh/authorized_keys. So if you specify same key in different key files in keys/ then when hg do ssh it will use first occurence of the key in authorixed_keys and probbaly refer to first only repo and disable access to another repos which refer to another file (but with same key)

yshurik
  • 11
  • 1