My problem required 3 separate repositories that could be locked down by AD group. These repositories also required both a physical separation and logical separation per company policy. The solution I came up with is as follows.
First and foremost, I did away with the whole "Virtual Application" implementation and opted to host each instances on IIS w/one IP address by creating new IIS web sites bound to the machines IP address using Site Bindings via host name so IIS could resolve to the proper instance. Accordingly - this required 3 internal DNS entries. If working locally you could probably get away with editing your LMHost file.
Example:
- Instance 1 = git1.domain.com
- Instance 2 = git2.domain.com
- Instance 3 = git3.domain.com
Once these 3 bindings were created, I simply modified the web.config for AD Windows authentication using our AD groups to map users to Teams.
As for the repositories, I placed them in a completely different directory outside of the web apps and changed the settings in the Bonobo WebApp to point to the appropriate repository for that instance.
Example:
- Instance 1 = Repo Path: D:\Repositories\Repo1, Security (ADGroup1, GitAdmin)
- Instance 2 = Repo Path: D:\Repositories\Repo2, Security (ADGroup2, GitAdmin)
- Instance 3 = Repo Path: D:\Repositories\Repo3, Security (ADGroup3, GitAdmin)
The only draw back is that I am required to manage three websites versus just one. I'm actually not that concerned as it perfectly meets the requirements of company policies of having physical and logical isolation of the various repositories.
That said - I do think it would be wise for this project's sponser to consider supporting multiple repository paths because this is probably more common with organizations supporting multiple repository disk locations