Skip to content

08 User and Access Control

Athene gives you two levers for access: who the user is (authentication) and what the user can do (authorization). In practice, this means you can keep login simple while still enforcing strict per-repository read/write rules.

8.1 Prerequisites

  • Local admin-capable credentials from 03 First-Time Setup and Access.
  • password-file authenticator enabled.
  • Athene running with persistent config and workspace mounts.

8.2 Quick Start

Step 1: List current users

athene user list

Step 2: Create a new user

athene user create alice --password change-this-now

Step 3: Verify user appears

athene user list

Step 4: Apply global access defaults

Edit access-control.ini under your Athene config root and set strict defaults first.

Alternative: open the same configuration through the CLI editor flow:

athene configuration access-control

Example baseline:

[repositories]
allow-read = *
allow-write = admin
deny-write = guest

Step 5: Add per-repository override when needed

Create repository.ini in the repository root when one repository needs different rules.

Alternative: open repository configuration through the CLI editor flow:

athene debian configuration main repository

[repository]
allow-read = *
allow-write = release-bot
deny-write = guest

Step 6: Validate with a non-admin identity

Run one read and one write action as the test user to confirm policy behavior is what you intended.

8.3 Key Parameters Explained

  • athene user list|create|delete|set-password|change-password: user lifecycle controls.
  • allow-read / allow-write: who is allowed by default.
  • deny-read / deny-write: explicit block list when allow rules are too broad.
  • repository.ini: fine-grained overrides for one repository.

Tip

Start with restrictive global write access and open only what you need. Teams that start permissive usually accumulate hidden write paths and discover them during incident response.

8.4 Operational Notes

  • user commands are global and not backend-specific.
  • change-password validates old credentials and does not require admin role for that same account.
  • User management commands are available only when password-file authenticator is enabled.

Next chapter: 09 Personal Access Tokens.