nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Stash Project Permissions

Chris Tietgen_dnp8nf

We're using the old Stash Server product, but will be upgrading to the latest Bitbucket Server soon and I'm having an issue restricting who can see what in Stash.

I've create Projects, for example "Project 1" and "Project 2" and I want to limit who can see the repos in those Projects.

For example, Group 1 should have access to Project 1, but not Project 2.

Under Project > Settings > Project Permissions we assign Group 1 to the Project.

However, doing the above doesn't prevent Group 2 from accessing the Project or the Repos under the Project.

What am I doing wrong?

Accepted answers

Julius Davies _GitBoost_com_

At the project level make sure "Public access" is disabled and that "Default permission" is set to "No access". Like so:

You might need to double-check those two settings are configured appropriately for each project AND repository, since repositories can override it. In newer Bitbucket versions repositories can only override the "Public access" value, but IIRC that was not always the case.

Take a look at our free Control Freak add-on, too! Very handy for controlling server-side git policy from a single place (e.g., enforcing pull-requests for specific branches, matching commits to JIRA tickets, etc).

All comments

Julius Davies _GitBoost_com_

At the project level make sure "Public access" is disabled and that "Default permission" is set to "No access". Like so:

Chris Tietgen_dnp8nf

I verified that the Project permissions are set, as described above, and that the repo permissions are set correctly, but the user can still see stuff they shouldn't be able to see.

Technically, the repo permissions aren't set, so they shouldn't be overriding the Project level permissions, right?

I'll take a look at Control Freak, though it doesn't seem like it'll address my issue.

Julius Davies _GitBoost_com_

Yes, Control Freak is more something to explore later once you get these basic permissions working.

The permission system on Bitbucket Server is solid in my experience. Is there any chance the user from Group 2 you're using to test permissions has any one of the following attributes?

Are they also a member of Group 1?
Do they have the global "Admin" privilege?
Do they have the global "System Admin" privilege?

Attributes #2 and #3 above give the user full read/write access to all repositories across your Bitbucket instance, regardless of the user's group memberships. Take a look at the "Global Permissions" screen (Settings --> Global Permissions) to see if #2 or #3 might be the problem.

To see how things should behave you can try my demo server:

http://vm.bit-booster.com/bitbucket/projects/ABC/repos/private

When I login with user "test" (password "test"), I get a simple "401 - Access is denied" page.

Chris Tietgen_dnp8nf

Oddly, all users recently added show as having the *System Admin* and *Admin* permissions, but I am not sure why. Is there a way to prevent new users from getting those permissions by default?

I inherited this task at work and I'm trying to clean up our permissions before we migrate to the latest Bitbucket Server.

I'll speak to our CEO to see if he has the *Sys.Admin* password and make some changes.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

bitbucket

bitbucket-server