[cvsnt] Re: Commit aborted - rejected access help

[Tony Hoyle]

John Bunk wrote:
> I have a CVSNT v2.5.03 (Scorpio) Build 2151 server on my Windows 2000
> SP4 machine with repository under repository C:\cvsroot and I'm
> running WinCVS v2.0.2.4 (Build 4) on another machine.  Server is
> logged in as "foo" (not using actual names!) under Administrator
> group under "bar" domain.  Create another NT user account called
> "fee" under Administrator group under "localmachine" domain.
> C:\cvsroot folder (and all child folder) security shows EVERYONE and
> SYSTEM having full access to all folders including and under
> c:\cvsroot.  As far as NT ACLs are concerned, this should be OK.
> 
> Created CVS names "cvs passwd -r foo -a foo" and "cvs passwd -r fee
> -a fee".
> 
> As a side note: interestingly enough, CVSNT WILL NOT let me create a
> CVS account with a "real user" under the "bar" domain, EVEN THOUGH
> THAT REAL USER _IS_ IN the server machine's user list!!??!?!  I put
> it there!  I can give screen dumps to show this...

That'll be a local configuration problem.  CVSNT doesn't have any say on 
what are valid users, it just asks the system if they exists and reports 
the answer.

> Another side note:  Why did I do "cvs passwd -r fee -a fee" when I
> could have used the "foo" real user (cvs passwd -r foo -a fee)?
> Because SSPI takes the _NT PASSWORD_, _NOT_ the password set at "cvs
> passwd" time!?!?!?!  I've confirmed this over and over again, and

It's documented in several places that cvs passwd sets the *pserver* 
password.

Forget about cvs passwd.  If you're using sspi it's an entirely 
superfluous command.

> When I log in with WinCVS on another machine with CVSROOT as
> ":sspi:fee@<server IP addr>:/cvsroot", I can log in successfully.

cvs has no real login concept.  The 'cvs login' command is used for 
storing local passwords for protocols that can't retrieve them 
automatically - again, this affects mostly pserver.  You can log in over 
sspi but this is not normally required unless you're trying to access 
from a remote site across the internet.

> "cvs [commit aborted]: authorization failed: server <server IP
> address> rejected access to /cvsroot for user foo"
>
> Um, I logged in as FEE, _NOT_ FOO!  I've searched the internet for
> answers and they certainly aren't in any FAQ.  I've seen others ask

No, you checked out the repository with a username specified.  If you 
want to use different usernames with the same sandbox you don't specify 
the username on checkout and it'll use the current one.   This is a FAQ 
and is answered on the wincvs lists every few days.

Tony