ProGet permissions / 500 Error

I need to set up the following behavior for our ProGet evaluation:

Repositories R1, R2

Developers A, B

A needs to be able to access R1 and R2 and upload packages, but most not see R3.

B need to have access to R1 but must not be able to see R2 or R3.

In order to achieve this, I created the two feeds for R1 and R2, and gave the following permissions:

A: Administrator R1, Administrator R2
B: Developer R1

However, unless I give View Only permissions (system) to A and B, they cannot navigate the website, since every second page leads to an 500.

And even if I give View Only permissions to all, A still can only upload using nuget.exe cmdline, but not using the website (again, 500).

How do I solve this?

The easiest way to accomplish this would be to:

Grant Administrator to A at system level
Deny Administrator to A at R3 scope

and

Grant Administrator to B at system level
Deny Administrator to B at R2 scope
Deny Administrator to B at R3 scope

since Deny takes precedence over Grant.

You can also group those users and instead of granting both individually, just grant the group.

Thanks Tod, this solves the problem partially. Now they can upload packages, but the 'browse packages' button on the front page always links to the first repository (the repo with a name that is first on alphabetic ordering).

Now if a developer doesn't have rights to it (because we deny them those rights), he still gets the 500 screen.

Seems like a bug to me. Or is there a config settings that I can use so that browse packages actually shows the packages that a user can see instead of blindly trying to present the first repo?

Ah, yes, that is indeed a bug. The home page "Browse" should link to the first available feed. I've logged this as PG-121 and we will fix in a future version of ProGet.

The "Feeds" navigation link, however, will show the available packages.