.. _changelog:

=========

Changelog

=========

1.6.0 (**2013-XX-XX**)

----------------------

:status: in-progress

:branch: beta

news

++++

fixes

+++++

1.5.3 (**2013-02-12**)

----------------------

news

++++

- IP restrictions now also enabled for IPv6

fixes

+++++

- fixed issues with private checkbox not always working

- fixed #746 unicodeDedode errors on feed controllers

- fixes issue #756 cleanup repos didn't properly compose paths of repos to be cleaned up.

- fixed cache invalidation issues together with vcs_full_cache option

- repo scan should skip directories with starting with '.'

- fixes for issue #731, update-repoinfo sometimes failed to update data when changesets

  were initial commits

- recursive mode of setting permission skips private repositories

1.5.2 (**2013-01-14**)

----------------------

news

++++

- IP restrictions for users. Each user can get a set of whitelist IP+mask for

  extra protection. Useful for buildbots etc.

- added full last changeset info to lightweight dashboard. lightweight dashboard

  is now fully functional replacement of original dashboard.

- implemented certain API calls for non-admin users.

- enabled all Markdown Extra plugins

- implemented #725 Pull Request View - Show origin repo URL

- show comments from pull requests into associated changesets

fixes

+++++

- update repoinfo script is more failsafe

- fixed #687  Lazy loaded tooltip bug with simultaneous ajax requests

- fixed #691: Notifications for pull requests: move link to top for better

  readability

- fixed #699: fix missing fork docs for API

- fixed #693 Opening changeset from pull request fails

- fixed #710 File view stripping empty lines from beginning and end of file

- fixed issues with getting repos by path on windows, caused GIT hooks to fail

- fixed issues with groups paginator on main dashboard

- improved fetch/pull command for git repos, now pulling all refs

- fixed issue #719 Journal revision ID tooltip AJAX query path is incorrect

  when running in a subdir

- fixed issue #702 API methods without arguments fail when "args":null

- set the status of changesets initially on pull request. Fixes issues #690 and #587

1.5.1 (**2012-12-13**)

----------------------

news

++++

- implements #677: Don't allow to close pull requests when they are

  under-review status

- implemented #670 Implementation of Roles in Pull Request

fixes

+++++

- default permissions can get duplicated after migration

- fixed changeset status labels, they now select radio buttons

- #682 translation difficult for multi-line text

- #683 fixed difference between messages about not mapped repositories

- email: fail nicely when no SMTP server has been configured

1.5.0 (**2012-12-12**)

----------------------

news

++++

- new rewritten from scratch diff engine. 10x faster in edge cases. Handling

  of file renames, copies, change flags and binary files

- added lightweight dashboard option. ref #500. New version of dashboard

  page that doesn't use any VCS data and is super fast to render. Recommended

  for large amount of repositories.

- implements #648 write Script for updating last modification time for

  lightweight dashboard

- implemented compare engine for git repositories.

- LDAP failover, option to specify multiple servers

- added Errormator and Sentry support for monitoring RhodeCode

- implemented #628: Pass server URL to rc-extensions hooks

- new tooltip implementation - added lazy loading of changesets from journal

  pages. This can significantly improve speed of rendering the page

- implements #632,added branch/tag/bookmarks info into feeds

  added changeset link to body of message

- implemented #638 permissions overview to groups

- implements #636, lazy loading of history and authors to speed up source

  pages rendering

- implemented #647, option to pass list of default encoding used to

  encode to/decode from unicode

- added caching layer into RSS/ATOM feeds.

- basic implementation of cherry picking changesets for pull request, ref #575

- implemented #661 Add option to include diff in RSS feed

- implemented file history page for showing detailed changelog for a given file

- implemented #663 Admin/permission: specify default repogroup perms

- implemented #379 defaults settings page for creation of repositories, locking

  statistics, downloads, repository type

- implemented #210 filtering of admin journal based on Whoosh Query language

- added parents/children links in changeset viewref #650

fixes

+++++

- fixed git version checker

- #586 patched basic auth handler to fix issues with git behind proxy

- #589 search urlgenerator didn't properly escape special characters

- fixed issue #614 Include repo name in delete confirmation dialog

- fixed #623: Lang meta-tag doesn't work with C#/C++

- fixes #612 Double quotes to Single quotes result in bad html in diff

- fixes #630 git statistics do too much work making them slow.

- fixes #625 Git-Tags are not displayed in Shortlog

- fix for issue #602, enforce str when setting mercurial UI object.

  When this is used together with mercurial internal translation system

  it can lead to UnicodeDecodeErrors

- fixes #645 Fix git handler when doing delete remote branch

- fix issue #504 RhodeCode is showing different versions of README on

  different summary page loads

- implemented #658 Changing username in LDAP-Mode should not be allowed.

- fixes #652 switch to generator approach when doing file annotation to prevent

  huge memory consumption

- fixes #666 move lockkey path location to cache_dir to ensure this path is

  always writable for rhodecode server

- many more small fixes and improvements

- fixed issues with recursive scans on removed repositories that could take

  long time on instance start

1.4.4 (**2012-10-08**)

----------------------

news

++++

- obfuscate db password in logs for engine connection string

- #574 Show pull request status also in shortlog (if any)

- remember selected tab in my account page

- Bumped mercurial version to 2.3.2

- #595 rcextension hook for repository delete

fixes

+++++

- Add git version detection to warn users that Git used in system is to

  old. Ref #588 - also show git version in system details in settings page

- fixed files quick filter links

- #590 Add GET flag that controls the way the diff are generated, for pull

  requests we want to use non-bundle based diffs, That are far better for

  doing code reviews. The /compare url still uses bundle compare for full

  comparison including the incoming changesets

- Fixed #585, checks for status of revision where to strict, and made

  opening pull request with those revision impossible due to previously set

  status. Checks now are made also for the repository.

- fixes #591 git backend was causing encoding errors when handling binary

  files - added a test case for VCS lib tests

- fixed #597 commits in future get negative age.

- fixed #598 API docs methods had wrong members parameter as returned data

1.4.3 (**2012-09-28**)

----------------------

news

++++

- #558 Added config file to hooks extra data

- bumped mercurial version to 2.3.1

- #518 added possibility of specifying multiple patterns for issues

- update codemirror to latest version

fixes

+++++

- fixed #570 explicit user group permissions can overwrite owner permissions

- fixed #578 set proper PATH with current Python for Git

  hooks to execute within same Python as RhodeCode

- fixed issue with Git bare repos that ends with .git in name

1.4.2 (**2012-09-12**)

----------------------

news

++++

- added option to menu to quick lock/unlock repository for users that have

  write access to

- Implemented permissions for writing to repo

  groups. Now only write access to group allows to create a repostiory

  within that group

- #565 Add support for {netloc} and {scheme} to alternative_gravatar_url

- updated translation for zh_CN

fixes

+++++

- fixed visual permissions check on repos groups inside groups

- fixed issues with non-ascii search terms in search, and indexers

- fixed parsing of page number in GET parameters

- fixed issues with generating pull-request overview for repos with

  bookmarks and tags, also preview doesn't loose chosen revision from

  select dropdown

1.4.1 (**2012-09-07**)

----------------------

news

++++

- always put a comment about code-review status change even if user send

  empty data

- modified_on column saves repository update and it's going to be used

  later for light version of main page ref #500

- pull request notifications send much nicer emails with details about pull

  request

- #551 show breadcrumbs in summary view for repositories inside a group

fixes

+++++

- fixed migrations of permissions that can lead to inconsistency.

  Some users sent feedback that after upgrading from older versions issues

  with updating default permissions occurred. RhodeCode detects that now and

  resets default user permission to initial state if there is a need for that.

  Also forces users to set the default value for new forking permission.

- #535 improved apache wsgi example configuration in docs

- fixes #550 mercurial repositories comparision failed when origin repo had

  additional not-common changesets

- fixed status of code-review in preview windows of pull request

- git forks were not initialized at bare repos

- fixes #555 fixes issues with comparing non-related repositories

- fixes #557 follower counter always counts up

- fixed issue #560 require push ssl checkbox wasn't shown when option was

  enabled

- fixed #559

- fixed issue #559 fixed bug in routing that mapped repo names with <name>_<num> in name as

  if it was a request to url by repository ID

1.4.0 (**2012-09-03**)

----------------------

news

++++

- new codereview system

- email map, allowing users to have multiple email addresses mapped into

  their accounts

- improved git-hook system. Now all actions for git are logged into journal

  including pushed revisions, user and IP address

- changed setup-app into setup-rhodecode and added default options to it.

- new git repos are created as bare now by default

- #464 added links to groups in permission box

- #465 mentions autocomplete inside comments boxes

- #469 added --update-only option to whoosh to re-index only given list

  of repos in index

- rhodecode-api CLI client

- new git http protocol replaced buggy dulwich implementation.

  Now based on pygrack & gitweb

- Improved RSS/ATOM feeds. Discoverable by browsers using proper headers, and

  reformated based on user suggestions. Additional rss/atom feeds for user

  journal

- various i18n improvements

- #478 permissions overview for admin in user edit view

- File view now displays small gravatars off all authors of given file

- Implemented landing revisions. Each repository will get landing_rev attribute

  that defines 'default' revision/branch for generating readme files

- Implemented #509, RhodeCode enforces SSL for push/pulling if requested at

  earliest possible call.

- Import remote svn repositories to mercurial using hgsubversion.

- Fixed #508 RhodeCode now has a option to explicitly set forking permissions

- RhodeCode can use alternative server for generating avatar icons

- implemented repositories locking. Pull locks, push unlocks. Also can be done

  via API calls

- #538 form for permissions can handle multiple users at once

fixes

+++++

- improved translations

- fixes issue #455 Creating an archive generates an exception on Windows

- fixes #448 Download ZIP archive keeps file in /tmp open and results

  in out of disk space

- fixes issue #454 Search results under Windows include proceeding

  backslash

- fixed issue #450. Rhodecode no longer will crash when bad revision is

  present in journal data.

- fix for issue #417, git execution was broken on windows for certain

  commands.

- fixed #413. Don't disable .git directory for bare repos on deleting

- fixed issue #459. Changed the way of obtaining logger in reindex task.

- fixed #453 added ID field in whoosh SCHEMA that solves the issue of

  reindexing modified files

- fixed #481 rhodecode emails are sent without Date header

- fixed #458 wrong count when no repos are present

- fixed issue #492 missing `\ No newline at end of file` test at the end of

  new chunk in html diff

- full text search now works also for commit messages

1.3.6 (**2012-05-17**)

----------------------

news

++++

- chinese traditional translation

- changed setup-app into setup-rhodecode and added arguments for auto-setup

  mode that doesn't need user interaction

fixes

+++++

- fixed no scm found warning

- fixed __future__ import error on rcextensions

- made simplejson required lib for speedup on JSON encoding

- fixes #449 bad regex could get more than revisions from parsing history

- don't clear DB session when CELERY_EAGER is turned ON

1.3.5 (**2012-05-10**)

----------------------

news

++++

- use ext_json for json module

- unified annotation view with file source view

- notification improvements, better inbox + css

- #419 don't strip passwords for login forms, make rhodecode

  more compatible with LDAP servers

- Added HTTP_X_FORWARDED_FOR as another method of extracting

  IP for pull/push logs. - moved all to base controller

- #415: Adding comment to changeset causes reload.

  Comments are now added via ajax and doesn't reload the page

- #374 LDAP config is discarded when LDAP can't be activated

- limited push/pull operations are now logged for git in the journal

- bumped mercurial to 2.2.X series

- added support for displaying submodules in file-browser

- #421 added bookmarks in changelog view

fixes

+++++

- fixed dev-version marker for stable when served from source codes

- fixed missing permission checks on show forks page

- #418 cast to unicode fixes in notification objects

- #426 fixed mention extracting regex

- fixed remote-pulling for git remotes remopositories

- fixed #434: Error when accessing files or changesets of a git repository

  with submodules

- fixed issue with empty APIKEYS for users after registration ref. #438

- fixed issue with getting README files from git repositories

1.3.4 (**2012-03-28**)

----------------------

news

++++

- Whoosh logging is now controlled by the .ini files logging setup

- added clone-url into edit form on /settings page

- added help text into repo add/edit forms

- created rcextensions module with additional mappings (ref #322) and

  post push/pull/create repo hooks callbacks

- implemented #377 Users view for his own permissions on account page

- #399 added inheritance of permissions for user group on repos groups

- #401 repository group is automatically pre-selected when adding repos

  inside a repository group

- added alternative HTTP 403 response when client failed to authenticate. Helps

  solving issues with Mercurial and LDAP

- #402 removed group prefix from repository name when listing repositories

  inside a group

- added gravatars into permission view and permissions autocomplete

- #347 when running multiple RhodeCode instances, properly invalidates cache

  for all registered servers

fixes

+++++

- fixed #390 cache invalidation problems on repos inside group

- fixed #385 clone by ID url was loosing proxy prefix in URL

- fixed some unicode problems with waitress

- fixed issue with escaping < and > in changeset commits

- fixed error occurring during recursive group creation in API

  create_repo function

- fixed #393 py2.5 fixes for routes url generator

- fixed #397 Private repository groups shows up before login

- fixed #396 fixed problems with revoking users in nested groups

- fixed mysql unicode issues + specified InnoDB as default engine with

  utf8 charset

- #406 trim long branch/tag names in changelog to not break UI

1.3.3 (**2012-03-02**)

----------------------

news

++++

fixes

+++++

- fixed some python2.5 compatibility issues

- fixed issues with removed repos was accidentally added as groups, after

  full rescan of paths

- fixes #376 Cannot edit user (using container auth)

- fixes #378 Invalid image urls on changeset screen with proxy-prefix

  configuration

- fixed initial sorting of repos inside repo group

- fixes issue when user tried to resubmit same permission into user/user_groups

- bumped beaker version that fixes #375 leap error bug

- fixed raw_changeset for git. It was generated with hg patch headers

- fixed vcs issue with last_changeset for filenodes

- fixed missing commit after hook delete

- fixed #372 issues with git operation detection that caused a security issue

  for git repos

1.3.2 (**2012-02-28**)

----------------------

news

++++

fixes

+++++

- fixed git protocol issues with repos-groups

- fixed git remote repos validator that prevented from cloning remote git repos

- fixes #370 ending slashes fixes for repo and groups

- fixes #368 improved git-protocol detection to handle other clients

- fixes #366 When Setting Repository Group To Blank Repo Group Wont Be

  Moved To Root

- fixes #371 fixed issues with beaker/sqlalchemy and non-ascii cache keys

- fixed #373 missing cascade drop on user_group_to_perm table

1.3.1 (**2012-02-27**)

----------------------

news

++++

fixes

+++++

- redirection loop occurs when remember-me wasn't checked during login

- fixes issues with git blob history generation

- don't fetch branch for git in file history dropdown. Causes unneeded slowness

1.3.0 (**2012-02-26**)

----------------------

news

++++

- code review, inspired by github code-comments

- #215 rst and markdown README files support

- #252 Container-based and proxy pass-through authentication support

- #44 branch browser. Filtering of changelog by branches

- mercurial bookmarks support

- new hover top menu, optimized to add maximum size for important views

- configurable clone url template with possibility to specify  protocol like

  ssh:// or http:// and also manually alter other parts of clone_url.

- enabled largefiles extension by default

- optimized summary file pages and saved a lot of unused space in them

- #239 option to manually mark repository as fork

- #320 mapping of commit authors to RhodeCode users

- #304 hashes are displayed using monospace font

- diff configuration, toggle white lines and context lines

- #307 configurable diffs, whitespace toggle, increasing context lines

- sorting on branches, tags and bookmarks using YUI datatable

- improved file filter on files page

- implements #330 api method for listing nodes ar particular revision

- #73 added linking issues in commit messages to chosen issue tracker url

  based on user defined regular expression

- added linking of changesets in commit messages

- new compact changelog with expandable commit messages

- firstname and lastname are optional in user creation

- #348 added post-create repository hook

- #212 global encoding settings is now configurable from .ini files

- #227 added repository groups permissions

- markdown gets codehilite extensions

- new API methods, delete_repositories, grante/revoke permissions for groups

  and repos

fixes

+++++

- rewrote dbsession management for atomic operations, and better error handling

- fixed sorting of repo tables

- #326 escape of special html entities in diffs

- normalized user_name => username in api attributes

- fixes #298 ldap created users with mixed case emails created conflicts

  on saving a form

- fixes issue when owner of a repo couldn't revoke permissions for users

  and groups

- fixes #271 rare JSON serialization problem with statistics

- fixes #337 missing validation check for conflicting names of a group with a

  repository group

- #340 fixed session problem for mysql and celery tasks

- fixed #331 RhodeCode mangles repository names if the a repository group

  contains the "full path" to the repositories

- #355 RhodeCode doesn't store encrypted LDAP passwords

If your main directory (the same as set in RhodeCode settings) is for example

set to **/home/hg** and the repository you are using is named `rhodecode`, then

to clone via ssh you should run::

    hg clone ssh://user@server.com/home/hg/rhodecode

Using other external tools such as mercurial-server_ or using ssh key based

authentication is fully supported.

Note: In an advanced setup, in order for your ssh access to use the same

permissions as set up via the RhodeCode web interface, you can create an

authentication hook to connect to the rhodecode db and runs check functions for

permissions against that.

Setting up Whoosh full text search

----------------------------------

Starting from version 1.1 the whoosh index can be build by using the paster

command ``make-index``. To use ``make-index`` you must specify the configuration

file that stores the location of the index. You may specify the location of the

repositories (`--repo-location`).  If not specified, this value is retrieved

from the RhodeCode database.  This was required prior to 1.2.  Starting from

version 1.2 it is also possible to specify a comma separated list of

repositories (`--index-only`) to build index only on chooses repositories

skipping any other found in repos location

You may optionally pass the option `-f` to enable a full index rebuild. Without

the `-f` option, indexing will run always in "incremental" mode.

For an incremental index build use::

    paster make-index production.ini

For a full index rebuild use::

    paster make-index production.ini -f

building index just for chosen repositories is possible with such command::

 paster make-index production.ini --index-only=vcs,rhodecode

In order to do periodical index builds and keep your index always up to date.

It's recommended to do a crontab entry for incremental indexing.

An example entry might look like this::

    /path/to/python/bin/paster make-index /path/to/rhodecode/production.ini

When using incremental mode (the default) whoosh will check the last

modification date of each file and add it to be reindexed if a newer file is

available. The indexing daemon checks for any removed files and removes them

from index.

If you want to rebuild index from scratch, you can use the `-f` flag as above,

or in the admin panel you can check `build from scratch` flag.

Setting up LDAP support

-----------------------

RhodeCode starting from version 1.1 supports ldap authentication. In order

to use LDAP, you have to install the python-ldap_ package. This package is

available via pypi, so you can install it by running

using easy_install::

    easy_install python-ldap

using pip::

    pip install python-ldap

.. note::

   python-ldap requires some certain libs on your system, so before installing

   it check that you have at least `openldap`, and `sasl` libraries.

LDAP settings are located in admin->ldap section,

Here's a typical ldap setup::

 Connection settings

 Enable LDAP          = checked

 Host                 = host.example.org

 Port                 = 389

 Account              = <account>

 Password             = <password>

 Connection Security  = LDAPS connection

 Certificate Checks   = DEMAND

 Search settings

 Base DN              = CN=users,DC=host,DC=example,DC=org

 LDAP Filter          = (&(objectClass=user)(!(objectClass=computer)))

 LDAP Search Scope    = SUBTREE

 Attribute mappings

 Login Attribute      = uid

 First Name Attribute = firstName

 Last Name Attribute  = lastName

 E-mail Attribute     = mail

.. _enable_ldap:

Enable LDAP : required

    Whether to use LDAP for authenticating users.

.. _ldap_host:

Host : required

    LDAP server hostname or IP address. Can be also a comma separated

    list of servers to support LDAP fail-over.

.. _Port:

Port : required

    389 for un-encrypted LDAP, 636 for SSL-encrypted LDAP.

.. _ldap_account:

Account : optional

    Only required if the LDAP server does not allow anonymous browsing of

    records.  This should be a special account for record browsing.  This

    will require `LDAP Password`_ below.

.. _LDAP Password:

Password : optional

    Only required if the LDAP server does not allow anonymous browsing of

    records.

.. _Enable LDAPS:

Connection Security : required

    Defines the connection to LDAP server

    No encryption

        Plain non encrypted connection

    LDAPS connection

        Enable ldaps connection. It will likely require `Port`_ to be set to

        a different value (standard LDAPS port is 636). When LDAPS is enabled

        then `Certificate Checks`_ is required.

    START_TLS on LDAP connection

        START TLS connection

.. _Certificate Checks:

Certificate Checks : optional

    How SSL certificates verification is handled - this is only useful when

    `Enable LDAPS`_ is enabled.  Only DEMAND or HARD offer full SSL security

    while the other options are susceptible to man-in-the-middle attacks.  SSL

    certificates can be installed to /etc/openldap/cacerts so that the

    DEMAND or HARD options can be used with self-signed certificates or

    certificates that do not have traceable certificates of authority.

    NEVER

        A serve certificate will never be requested or checked.

    ALLOW

        A server certificate is requested.  Failure to provide a

        certificate or providing a bad certificate will not terminate the

        session.

    TRY

        A server certificate is requested.  Failure to provide a

        certificate does not halt the session; providing a bad certificate

        halts the session.

    DEMAND

        A server certificate is requested and must be provided and

        authenticated for the session to proceed.

    HARD

        The same as DEMAND.

.. _Base DN:

Base DN : required

    The Distinguished Name (DN) where searches for users will be performed.

    Searches can be controlled by `LDAP Filter`_ and `LDAP Search Scope`_.

.. _LDAP Filter:

LDAP Filter : optional

    A LDAP filter defined by RFC 2254.  This is more useful when `LDAP

    Search Scope`_ is set to SUBTREE.  The filter is useful for limiting

    which LDAP objects are identified as representing Users for

    authentication.  The filter is augmented by `Login Attribute`_ below.

    This can commonly be left blank.

.. _LDAP Search Scope:

LDAP Search Scope : required

    This limits how far LDAP will search for a matching object.

    BASE

        Only allows searching of `Base DN`_ and is usually not what you

        want.

    ONELEVEL

        Searches all entries under `Base DN`_, but not Base DN itself.

    SUBTREE

        Searches all entries below `Base DN`_, but not Base DN itself.

        When using SUBTREE `LDAP Filter`_ is useful to limit object

        location.

.. _Login Attribute:

Login Attribute : required

    The LDAP record attribute that will be matched as the USERNAME or

    ACCOUNT used to connect to RhodeCode.  This will be added to `LDAP

    Filter`_ for locating the User object.  If `LDAP Filter`_ is specified as

    "LDAPFILTER", `Login Attribute`_ is specified as "uid" and the user has

    connected as "jsmith" then the `LDAP Filter`_ will be augmented as below

    ::

        (&(LDAPFILTER)(uid=jsmith))

.. _ldap_attr_firstname:

First Name Attribute : required

    The LDAP record attribute which represents the user's first name.

.. _ldap_attr_lastname:

Last Name Attribute : required

    The LDAP record attribute which represents the user's last name.

.. _ldap_attr_email:

Email Attribute : required

    The LDAP record attribute which represents the user's email address.

If all data are entered correctly, and python-ldap_ is properly installed

users should be granted access to RhodeCode with ldap accounts.  At this

time user information is copied from LDAP into the RhodeCode user database.

This means that updates of an LDAP user object may not be reflected as a

user update in RhodeCode.

If You have problems with LDAP access and believe You entered correct

information check out the RhodeCode logs, any error messages sent from LDAP

will be saved there.

Active Directory

''''''''''''''''

RhodeCode can use Microsoft Active Directory for user authentication.  This

is done through an LDAP or LDAPS connection to Active Directory.  The

following LDAP configuration settings are typical for using Active

Directory ::

 Base DN              = OU=SBSUsers,OU=Users,OU=MyBusiness,DC=v3sys,DC=local

 Login Attribute      = sAMAccountName

 First Name Attribute = givenName

 Last Name Attribute  = sn

 E-mail Attribute     = mail

All other LDAP settings will likely be site-specific and should be

appropriately configured.

Authentication by container or reverse-proxy

--------------------------------------------

Starting with version 1.3, RhodeCode supports delegating the authentication

of users to its WSGI container, or to a reverse-proxy server through which all

clients access the application.

When these authentication methods are enabled in RhodeCode, it uses the

username that the container/proxy (Apache/Nginx/etc) authenticated and doesn't

perform the authentication itself. The authorization, however, is still done by

RhodeCode according to its settings.

When a user logs in for the first time using these authentication methods,

a matching user account is created in RhodeCode with default permissions. An

administrator can then modify it using RhodeCode's admin interface.

It's also possible for an administrator to create accounts and configure their

permissions before the user logs in for the first time.

Container-based authentication

''''''''''''''''''''''''''''''

In a container-based authentication setup, RhodeCode reads the user name from

the ``REMOTE_USER`` server variable provided by the WSGI container.

After setting up your container (see `Apache's WSGI config`_), you'd need

to configure it to require authentication on the location configured for

RhodeCode.

In order for RhodeCode to start using the provided username, you should set the

following in the [app:main] section of your .ini file::

    container_auth_enabled = true

Proxy pass-through authentication

'''''''''''''''''''''''''''''''''

In a proxy pass-through authentication setup, RhodeCode reads the user name

from the ``X-Forwarded-User`` request header, which should be configured to be

sent by the reverse-proxy server.

After setting up your proxy solution (see `Apache virtual host reverse proxy example`_,

`Apache as subdirectory`_ or `Nginx virtual host example`_), you'd need to

configure the authentication and add the username in a request header named

``X-Forwarded-User``.

For example, the following config section for Apache sets a subdirectory in a

reverse-proxy setup with basic auth::

    <Location /<someprefix> >

      ProxyPass http://127.0.0.1:5000/<someprefix>

      ProxyPassReverse http://127.0.0.1:5000/<someprefix>

      SetEnvIf X-Url-Scheme https HTTPS=1

      AuthType Basic

      AuthName "RhodeCode authentication"

      AuthUserFile /home/web/rhodecode/.htpasswd

      require valid-user

      RequestHeader unset X-Forwarded-User

      RewriteEngine On

      RewriteCond %{LA-U:REMOTE_USER} (.+)

      RewriteRule .* - [E=RU:%1]

      RequestHeader set X-Forwarded-User %{RU}e

    </Location>

In order for RhodeCode to start using the forwarded username, you should set

the following in the [app:main] section of your .ini file::