Support publishing using API-key in Gradle plugin

[skjolber]

Currently , it seems only username and password can be used for publishing:

https://github.com/jfrog/build-info/blob/master/build-info-extractor-gradle/src/main/groovy/org/jfrog/gradle/plugin/artifactory/task/DeployTask.java#L128

This effectively omits users registred using SSO.

[eyalbe4]

@skjolber,
Thank you for your question.
You can use an API Key today by providing it as the password task input. You do need to provide the API Key (similarly to the password) with the correct username. We prefer not to directly support providing an API Key without a username. Although it can work, it is not right way to authenticate with Artifactory.
We do however intend to add support for Access Tokens.

[skjolber]

@eyalbe4 thanks for the quick response. Is this documented anywhere?

This issue is then reduced to the following: The gradle plugin configuration should accept an api-key property and pass it along as a password.

[eyalbe4]

Thanks @skjolber.
Added this to the documentation.

[skjolber]

@eyalbe4 please add it to the Gradle extension too.

[eyalbe4]

@skjolber -
Are you referring to Gradle Artifactory Plugin documentation? That's were we added this.

[skjolber]

@eyalbe4 no, please update the configuration of the plugin, so I can write username+apiKey instead of username+password.

[yanickj]

We do however intend to add support for Access Tokens.

Any word on if or when this will be/was added? I can't seem to find anything in the docs for providing an access token as part of the credentials for publishing or resolving artifacts.

[yanickj]

So, after some tinkering I found that I was able to use the access token in the credentials. This seems to work with the following:

1. Decode the access token
2. username is in the "sub" claim (everything following the final "/")
3. password is the entire token

Perhaps this is covered above (or somewhere else), but I was thrown off by API Key vs Access Token. Also note that the username in the claim is different than the username I would use with my actual password, and it does not work with my password. Because this appears to be undocumented I am anxious that this solution might not work with future updates. Would anyone from the jfrog team to be able to confirm whether or not this is the correct approach?

[github-actions]

This issue has been marked as stale due to 6 months of inactivity. As part of our effort to address every issue properly, please feel free to remove the stale label or keep this issue active by leaving a comment. Otherwise, it will be closed in 7 days

[github-actions]

This issue was closed due to 7 days of inactivity after being marked as stale. Feel free to reopen it if it remains relevant.