BitBucket Server lets ANYONE view ANYTHING and AUTOMATICALLY adds them to our licence count

Nathan Pledger

Hi,

As the subject says, our BitBucket (10 licence version):

* Allows anyone with an AD login access to anything

* Automatically adds that user to our stash-users so it contributes to our licence count

We trialled the product and were really impressed by it, but this could be terminal. We cannot entertain this scenario from a cost/operational and security perspective.

I can't see how we can prevent this behaviour.

We:

* Do not have Public repos

* Operate on a private network (Active Directory managed)

* Have a single group ("stash-users") within a small team of developers. No-one else should have access.

I'd welcome guidance on this.

Thanks very much

 

Nathan

Nathan Pledger

Developing:

It _seems_ that a user who has not been in the system before is allowed in and is automatically added to the *stash-users* group.

This is very bad from a licensing and security perspective.

If I _remove_ that user explicitly from the *stash-users* group, the next time they try they get the "You do not have permission to access Bitbucket" message and can't log in.

Which suggests BitBucket has _rememberd_ they had access and this was removed. 

That sounds too crazy to be actually true.