KB: Altium Enterprise Server Edit Permission Error with External Git Clients

Solution Details

Recognize the Edit Permission Issue

You may receive the “You do not have edit permission” message even when you created the AES project or were granted edit access.

On the server, the corresponding request may return HTTP 403 Forbidden, and the affected user identity may appear without the expected Windows domain.

If the problem occurs only on computers with an external Git client installed, use the following procedure to determine whether Git configuration or an unexpected SSH operation is involved.

Understand Why Authentication Can Fail

Enterprise Server can use Windows Authentication and Windows session credentials. In the affected scenario, an external Git client or related Git configuration may cause an operation to use SSH instead of the expected authenticated HTTPS workflow.

An external Git client by itself does not prove the cause. Git hooks, SSH-based submodules, environment or Git configuration, repository state, or Git GUI behavior can provide the actual SSH trigger. OpenSSH being installed on the computer also does not by itself indicate a problem.

If SSH is unexpectedly invoked and the identity presented to AES does not contain the expected Windows domain information, access can be denied and the operation may return HTTP 403.

Use HTTPS and Remove SSH Triggers

• Use the connected Workspace and Altium Designer version-control workflow where applicable.
• When using Git CLI with the affected repository, use an HTTPS repository URL rather than an SSH URL.
• Check the Git configuration, Git hooks, and submodules for settings that invoke SSH.
• Check the project and its parent directories for unintended Git repositories that could affect repository behavior.
• Disable OpenSSH only if your IT administrator approves the change and confirms that OpenSSH is not required. Disabling OpenSSH is not the recommended first solution.

Diagnose and Correct the Git Configuration

1. Compare an unaffected environment.
   • Test AES access on a machine without Git for Windows or the affected Git GUI installed.
   • If the edit-permission error does not occur, treat the result as an isolation test rather than definitive proof that the Git client itself is the root cause.
   • Compare Git configuration, environment settings, hooks, submodules, repository structure, and installed Git components between the affected and unaffected systems.
2. Check which SSH executable is available.

   Run:

   where ssh

   Check whether the command resolves to:

   C:\Windows\System32\OpenSSH\ssh.exe

   The presence of this executable alone does not establish that SSH caused the AES error. Continue with the following checks to determine what is invoking it.

3. Inspect the Git configuration.

   Run:

   git config --list --show-origin

   Check the output for SSH-related settings and note the configuration file in which each relevant setting originates.

4. Check for Git hooks.

   List the repository hooks:

   dir .git\hooks

   Check whether a custom hooks path is configured:

   git config --show-origin --get core.hooksPath

   Identify and disable hooks that invoke SSH when they are not required for the AES workflow.

5. Check for SSH-based submodules.

   Run:

   git submodule status

   Identify SSH-based submodules and convert their URLs to appropriate HTTPS equivalents when required by the environment.

6. Inspect repository boundaries.

   Check the project directory and its parent directories for unintended .git repositories. A parent-directory Git repository can interfere with Git operations. If the repository state is uncertain, perform a fresh checkout into a clean directory to help isolate the local configuration.

7. Retest using an HTTPS-based workflow.

   After removing unintended SSH triggers, repeat the affected operation using the connected Workspace workflow or the appropriate Git-over-HTTPS configuration.

8. Disable OpenSSH only when approved.

   Proceed only if disabling OpenSSH is approved and confirmed safe for the environment. Disable it using Windows Optional Features or Apps & Features.

Additional Notes

• An OpenSSH credential prompt appearing during a local git commit operation is a reason to investigate hooks or other local Git configuration because the reported workflow is unexpectedly invoking SSH.
• SSO alone does not correct an operation that has taken an unintended SSH authentication path. Verify which authentication mechanism is actually being invoked.
• External Git GUIs can introduce client-side configuration and behavior outside the Enterprise Server configuration. Troubleshooting may therefore require comparison of the Git client, Git configuration, hooks, submodules, environment, and repository state.
• Avoid assuming that the presence of OpenSSH or an external Git client alone proves causation. Confirm the component or configuration that invokes SSH before making system-level changes.
• To reduce recurrence, use the appropriate HTTPS-based workflow for affected repositories and validate external Git tooling and configuration before deployment.
• A related feature request is available in Altium BugCrunch.  For additional information or to follow its status, see BugCrunch item 22172: https://bugcrunch.live.altium.com/#/bug/22172. BugCrunch access requires an AltiumLive sign-in.

References

• Configuring LDAP Sync | Altium On-Prem Enterprise Server - Advanced Topics
• Exploring the Browser-based Interface | Altium On-Prem Enterprise Server
• Using External Version Control | Altium Designer