Q: howto require per-branch authentication to commit or, push changes

[Adrian Wilkins]

Mark Hammond wrote:
> On 5/04/2009 2:50 AM, Adrian Wilkins wrote:
>>> A lot of Windows shops would probably like to put bzr behind IIS and
>>> configure NTLM or Kerberos security to control access giving them
>>> password-less authentication and centralized user management.
>>
>> I'm using an IIS smart server with Basic authentication. One caveat is
>> that certain versions of IIS don't support smart and dumb access at the
>> same time without additional effort.
> 
> I've got a fair bit of experience with IIS versions 5 and up and have
> never come across this - what problems were they?
> 

I believe we communicated on the matter at the time ; the problems are
to do with URL redirection to specific handlers (ie - directing */smart
links to the WSGI gateway). IIS 7 (Vista) is capable of doing this
out-of-the-box (and detail on how to do it is at ServerGuide/IIS) ; the
"additional effort" is installing third-party components beyond PyISAPIe
to do this on IIS 5 and 6 (or finding the way of getting PyISAPIe to
pass certain URLs back to IIS), which I never found a way to do (mainly
through apathy).

Because bzr uses "dumb" access to determine whether it uses "smart"
mode, this means that I have to specify bzr+http:// to use my server,
but it's not much of a hardship, a lot of the VCS access is abstracted
behind shell scripts for my userbase.

A how-to on the remaining bits would be a welcome addition to the wiki
page! ;-)