I am evaluating the possibilities of moving my organisation to Mercurial, however I am stumbling on 2 basic requirements which I can't find proper pointers to.

How do I set up Mercurial's central repository to authenticate users with the central active directory and only allow them to push or pull if they have the right credentials?

How do I set up a Mercurial project repository to only allow users pertaining to a specific group to push / pull source code? We need this to have per-project authorisation.

On which HTTP servers (IIS or Apache etc.) are the above 2 requirements supported?

Apologies if I am asking something obvious or if I am missing something fundamental about how authentication and authorisation works.

Thanks.