Repository navigation
[JENKINS-48775] Proxy authentication error 407 even if 'check proxy' works #22494
Description
Proxy configuration doesn't work even if 'check proxy' works! No workaround found.
Situation: Fresh installed Windows Server 2016 with latest, fresh installed LTS Jenkins version 2.89.2. Server is behind a proxy. Check of Jenkins proxy configuration says 'Ok' but checking plugins crashes jenkins (see attached screen shot).
I have a second machine (Windows 7 enterprise) with the same Jenkins version, behind the same proxy, with (really!) the same proxy configuration: Check Jenkins proxy settings says: "Error 407", BUT: Checking plugins works! (WTF!?!) One differrence is the java runtime verision: on this machine = 1.8.0_66-b18.
Originally reported by 
go, imported from: Proxy authentication error 407 even if 'check proxy' works
- status: Resolved
- priority: Critical
- component(s): core
- label(s): 2.150.1-rejected, 2.150.2-rejected, 2.150.3-rejected, Proxy
- resolution: Fixed
- resolved: 2018-11-20T14:53:06+00:00
- votes: 7
- watchers: 14
- imported: 2025-11-24
Raw content of original issue
Proxy configuration doesn't work even if 'check proxy' works! No workaround found.
Situation: Fresh installed Windows Server 2016 with latest, fresh installed LTS Jenkins version 2.89.2. Server is behind a proxy. Check of Jenkins proxy configuration says 'Ok' but checking plugins crashes jenkins (see attached screen shot).
I have a second machine (Windows 7 enterprise) with the same Jenkins version, behind the same proxy, with (really!) the same proxy configuration: Check Jenkins proxy settings says: "Error 407", BUT: Checking plugins works! (WTF!?!) One differrence is the java runtime verision: on this machine = 1.8.0_66-b18.
environment
awt.toolkit sun.awt.windows.WToolkit<br/>
executable-war D:\Jenkins\jenkins.war<br/>
file.encoding Cp1252<br/>
file.encoding.pkg sun.io<br/>
file.separator \<br/>
hudson.lifecycle hudson.lifecycle.WindowsServiceLifecycle<br/>
java.awt.graphicsenv sun.awt.Win32GraphicsEnvironment<br/>
java.awt.headless true<br/>
java.awt.printerjob sun.awt.windows.WPrinterJob<br/>
java.class.path D:\Jenkins\jenkins.war<br/>
java.class.version 52.0<br/>
java.endorsed.dirs D:\Jenkins\jre\lib\endorsed<br/>
java.ext.dirs D:\Jenkins\jre\lib\ext;C:\Windows\Sun\Java\lib\ext<br/>
java.home D:\Jenkins\jre<br/>
java.library.path D:\Jenkins\jre\bin;C:\Windows\Sun\Java\bin;C:\Windows\system32;C:\Windows;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;.<br/>
java.runtime.name Java(TM) SE Runtime Environment<br/>
java.runtime.version 1.8.0_144-b01<br/>
java.specification.name Java Platform API Specification<br/>
java.specification.vendor Oracle Corporation<br/>
java.specification.version 1.8<br/>
java.vendor Oracle Corporation<br/>
java.vendor.url <a href="http://java.oracle.com/">http://java.oracle.com/</a><br/>
java.vendor.url.bug <a href="http://bugreport.sun.com/bugreport/">http://bugreport.sun.com/bugreport/</a><br/>
java.version 1.8.0_144<br/>
java.vm.info mixed mode<br/>
java.vm.name Java HotSpot(TM) Client VM<br/>
java.vm.specification.name Java Virtual Machine Specification<br/>
java.vm.specification.vendor Oracle Corporation<br/>
java.vm.specification.version 1.8<br/>
java.vm.vendor Oracle Corporation<br/>
java.vm.version 25.144-b01<br/>
jna.loaded true<br/>
line.separator <br/>
os.arch x86<br/>
os.name Windows Server 2016<br/>
os.version 10.0<br/>
path.separator ;<br/>
sun.arch.data.model 32<br/>
sun.boot.class.path D:\Jenkins\jre\lib\resources.jar;D:\Jenkins\jre\lib\rt.jar;D:\Jenkins\jre\lib\sunrsasign.jar;D:\Jenkins\jre\lib\jsse.jar;D:\Jenkins\jre\lib\jce.jar;D:\Jenkins\jre\lib\charsets.jar;D:\Jenkins\jre\lib\jfr.jar;D:\Jenkins\jre\classes<br/>
sun.boot.library.path D:\Jenkins\jre\bin<br/>
sun.cpu.endian little<br/>
sun.cpu.isalist pentium_pro+mmx pentium_pro pentium+mmx pentium i486 i386 i86<br/>
sun.desktop windows<br/>
sun.io.unicode.encoding UnicodeLittle<br/>
sun.java.command D:\Jenkins\jenkins.war --httpPort=8080 --webroot=D:\Jenkins\war<br/>
sun.java.launcher SUN_STANDARD<br/>
sun.jnu.encoding Cp1252<br/>
sun.management.compiler HotSpot Client Compiler<br/>
sun.os.patch.level <br/>
user.country US<br/>
user.country.format AT<br/>
user.dir D:\Jenkins<br/>
user.language en<br/>
user.language.format de<br/>
user.script <br/>
user.timezone Europe/Berlin<br/>
user.variant <br/>
Umgebungsvariablen<br/>
Name ↓<br/>
Wert <br/>
ALLUSERSPROFILE C:\ProgramData<br/>
BASE D:\Jenkins<br/>
CommonProgramFiles C:\Program Files (x86)\Common Files<br/>
CommonProgramFiles(x86) C:\Program Files (x86)\Common Files<br/>
CommonProgramW6432 C:\Program Files\Common Files<br/>
ComSpec C:\Windows\system32\cmd.exe<br/>
JENKINS_HOME D:\Jenkins<br/>
NUMBER_OF_PROCESSORS 2<br/>
OS Windows_NT<br/>
Path C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\<br/>
PATHEXT .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC<br/>
PROCESSOR_ARCHITECTURE x86<br/>
PROCESSOR_ARCHITEW6432 AMD64<br/>
PROCESSOR_IDENTIFIER Intel64 Family 6 Model 26 Stepping 4, GenuineIntel<br/>
PROCESSOR_LEVEL 6<br/>
PROCESSOR_REVISION 1a04<br/>
ProgramData C:\ProgramData<br/>
ProgramFiles C:\Program Files (x86)<br/>
ProgramFiles(x86) C:\Program Files (x86)<br/>
ProgramW6432 C:\Program Files<br/>
PSModulePath %ProgramFiles%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules<br/>
PUBLIC C:\Users\Public<br/>
RANDFILE C:\ProgramData\.rnd<br/>
SERVICE_ID Jenkins<br/>
SystemDrive C:<br/>
SystemRoot C:\Windows<br/>
UATDATA C:\Windows\CCM\UATData\D9F8C395-CAB8-491d-B8AC-179A1FE1BE77<br/>
windir C:\Windows<br/>
WINSW_EXECUTABLE D:\Jenkins\jenkins.exe<br/>
WINSW_SERVICE_ID Jenkins<br/>
Plugins:<br/>
Keine Plugins installiert.
Activity
jenkins-infra-bot commentedon Jan 2, 2018
Remote links associated with this issue:
jenkins-infra-bot commentedon Jan 2, 2018
Raw content of original comment:
From the release notes:
i.e. as you mention, the Java version makes a difference.
jenkins-infra-bot commentedon Jan 2, 2018
Raw content of original comment:
Hi Christopher,
at first thank you for your fast answer!
Unfortunately, the situation on my both Jenkins servers is inverted: That one with JRE 1.8.0_66-b18 is working and the one with 1.8.0_144-b01 isn't working. Even the 'proxy check' is the other way around.
bg Gerald
jenkins-infra-bot commentedon Jan 3, 2018
Raw content of original comment:
due to the situation that the Jenkins Server with the newer JRE makes the troubles => still an issue.
jenkins-infra-bot commentedon Jan 12, 2018
Raw content of original comment:
Hi rtyler,
I have new gained insights of this problem:
After consulting out IT guys, it was clear that the Jenkins server DON'T send any authentication to the proxy (maybe except when pressing 'check proxy').
So there were made two configurations on the company proxy server:
1. added 'https://updates.jenkins.io' to the 'DoNotAuthenticate whitelist'
2. turned off the 'SSL Interception' for this URL
Now, with this workaround, checking and downloading plugin works! But that can't be the final solution!
Thank you for your effort!
BG Gerald
jenkins-infra-bot commentedon Jan 18, 2018
onodera:
Raw content of original comment:
I can confirm that I have the same problem with Jenkins 2.89.3 running on Oracle JRE 8u161 for x64 Linux: proxy configuration check succeeds, checking for plugins on Jenkins updates produces a stack trace about HTTP error 407.
jenkins-infra-bot commentedon Jan 25, 2018
ausername:
Raw content of original comment:
Jenkins 2.101 here.
Proxy Settings OK
Update Center / Advanced Proxy / Test OK
wget from within the docker container (when setting the proxy there): OK
wget from the host machine OK
Trying to get the plugin update infos - fails.
Proxy doesn't need an authentification.
jenkins-infra-bot commentedon Jan 31, 2018
Raw content of original comment:
Now I saw the difference of fetching the updates: The machine with the older JRE version checks '[*http://updates.jenkins-ci.org/update-center.json*'] and the newer one (fresh installled Jenklins 2.89.2) calls '*https://updates.jenkins.io/update-center.json'*!
So this exlains the different behavier but not what's going on in the newer Jenkins software!
bg Gerald
jenkins-infra-bot commentedon Feb 1, 2018
ausername:
Raw content of original comment:
Jenkins Docker Container with V2.101 and Java 1.8.0.151 still an issue
jenkins-infra-bot commentedon Feb 6, 2018
Raw content of original comment:
WORKAROUND:
This is crazy, but will work...
Run the following in the script console:
Then the update center should work... unclear why this works at this point in time!
jenkins-infra-bot commentedon Feb 6, 2018
Raw content of original comment:
Interestingly...
Will give the
java.io.IOException: Unable to tunnel through proxy. Proxy returns "HTTP/1.1 407 Proxy Authentication Required"error... looks like a JDK bug whereby the HttpsURLConnectionImpl wherein it will fail to setup a connection to the proxy but will reuse an existing one
jenkins-infra-bot commentedon Feb 6, 2018
Raw content of original comment:
Ok, so Http URLs will populate the sun.net.www.protocol.http.AuthenticationInfo.cache.hashtable but Https URLs will not populate, only consult
jenkins-infra-bot commentedon Feb 6, 2018
Raw content of original comment:
FYI the workaround may only last for a short-ish period of time as the cache seems to get purged under circumstances I have been unable to determine
jenkins-infra-bot commentedon May 9, 2018
israelromero:
Raw content of original comment:
Same issue with 2.107.2 version
jenkins-infra-bot commentedon Jun 6, 2018
Raw content of original comment:
For us it is fixed, probably either by removal of a duplicate update center we had (same update center twice, disappeared after update and restart) or with the update to 2.107.3 (possibly related in the changelog: "Add new update center root CA certificate. (INFRA-1502)" ?)
1 remaining item
jenkins-infra-bot commentedon Oct 25, 2018
fuku1026:
Raw content of original comment:
Same issue with 2.138.2 version
jenkins-infra-bot commentedon Oct 25, 2018
israelromero:
Raw content of original comment:
I respond to myself here to help anyone with same issue.
The problem wasn't Jenkins. Problem comes from Java JDK8 and above. Since this version, Oracle has disabled basic auth tunnelling for Basic authentication. If you want to use Basic mode again (security will be compromised), execute Jenkins adding this parameter to your JAVA_OPTS variable:
"-Djdk.http.auth.tunneling.disabledSchemes="
default value is
"-Djdk.http.auth.tunneling.disabledSchemes=Basic", so Basic Schema is DISABLED by default and will return HTTP 407 error even if your credentials were OK.
Proxy checking must use other method to validate Internet connection...
I hope this can help you, guys.
jenkins-infra-bot commentedon Oct 31, 2018
Raw content of original comment:
Removing myself as assignee. My current work assignments do not provide sufficient bandwidth to review these issues and in the majority of cases I am only assigned by virtue of being the default assignee. For the credentials-api and scm-api related plugins I have permission to allocate time reviewing changes to these APIs themselves to ensure these APIs remain cohesive, but that can be handled through PR reviews rather than assigning issues in JIRA
jenkins-infra-bot commentedon Nov 21, 2018
Raw content of original comment:
Postponing backport until 2.150.2 at least to give it some soak time.
jenkins-infra-bot commentedon Dec 4, 2018
Raw content of original comment:
This introduced
JENKINS-54903.jenkins-infra-bot commentedon Nov 24, 2025
[Original
relates_tofrom Jira: JENKINS-54903]jenkins-infra-bot commentedon Nov 24, 2025
[Original
relates_tofrom Jira: JENKINS-42089]