Restricting group and project creation

  1. Go to “Admin” → “Settings” → “General”.
  2. Expand “Visibility and access controls” and set “Default minimum role required to create projects” to the lowest role that may create projects on the instance.
  3. Expand “Account and limit”. In the “User restrictions” group, clear the “Allow new users to create top-level groups” and “Allow users with up to Guest role to create groups and personal projects” checkboxes.
  4. Click “Save changes” in every section you have changed.

The “Allow new users to create top-level groups” checkbox sets the default for accounts created after the change. For an account that already exists, the permission is set in “Admin” → “Overview” → “Users”: open the user, click “Edit” and set the “Can create top-level groups” value.

Enabled Git access protocols

The instance accepts Git operations over SSH and over HTTP(S). To leave one protocol:

  1. Go to “Admin” → “Settings” → “General”.
  2. Expand “Visibility and access controls”.
  3. In the “Enabled Git access protocols” list, select “Only SSH” or “Only HTTP(S)”.
  4. Click “Save changes”.

Git operations over the protocol that is left out are refused.

Password authentication for Git over HTTPS

  1. Go to “Admin” → “Settings” → “General”.
  2. Expand “Sign-in restrictions”.
  3. Clear the “Allow password authentication for Git over HTTP(S)” checkbox.
  4. Click “Save changes”.

A Git client then authenticates over HTTPS with a personal access token instead of the account password. When LDAP is configured, the LDAP password is accepted as well.

Two-factor authentication for the whole instance

  1. Go to “Admin” → “Settings” → “General”.
  2. Expand “Sign-in restrictions”.
  3. Select “Enforce two-factor authentication” to require the second factor from every user of the instance, or “Enforce two-factor authentication for administrators” to require it from administrators only.
  4. In the “Two-factor grace period” field, enter the number of hours during which a user may postpone the setup. The value 0 requires the setup at the next sign-in.
  5. Click “Save changes”.

A user who has not set the second factor up is asked to do so on the next sign-in. The methods a user can choose from are described on the Signing in page.

Push rules at the instance level

Push rules set in “Admin” → “Settings” → “Repository” → “Push rules” apply to every project of the instance: a group or a project receives them as its default values and changes them only while the rule allows an override. The rules themselves and the override are described on the Push rules page.

←
Administration / Overview
Authentication / Overview
→