Keep in mind that the base Mercurial model cannot actually check anyone. The only thing she can do is to prevent these users from uploading something to your copy of the repository.
IIS can configure authentication so that Mercurial knows which user is downloading, and therefore only some users are even allowed to try to download. If all you care about is restricting who has access to your repository, you can stop right here. But if you want something more granular, I think you're out of luck right now.
But if he ever finishes working with web server authentication, you will need to use the extension
source
share