Cannot use choco list on nuget repositories #1662

gretel · 2020-01-30T10:51:03Z

Bug Description

The default configuration has ANONYMOUS_ROLE set but trying to browse a nuget directory does always require authentication.

Steps To Reproduce

Deploy strongbox using default configuration
Enable "Allow directory browsing" in nuget-storage
Try to do any api transaction anonomously (like choco list)

Expected Behavior

Anonoymous users should be able to browse the directory as inherited by ARTIFACTS_RESOLVE

Environment

Strongbox Version: {"strongbox":{"version":"1.0-SNAPSHOT","revision":"eccd13064b1e3bfa"}}
OS: adoptopenjdk/openjdk8:jdk8u232-b09-alpine

The text was updated successfully, but these errors were encountered:

steve-todorov · 2020-01-30T12:17:59Z

These might be two different problems. Are you talking about choco list or about browsing /api/browse/storage/nuget-repository ?

gretel · 2020-01-30T12:20:09Z

@steve-todorov choco list should be possible anonymously.

anki2189 · 2020-02-06T10:21:49Z

@gretel : Please share source used for command choco list .

gretel · 2020-02-06T10:45:32Z

choco source add --name=strongbox --source=$internalRepositoryLocation --user=$internalRepositoryUser --password=$internalRepositoryScrt --priority=1 --bypass-proxy

anki2189 · 2020-02-06T17:34:56Z

There is a method in NugetArtifactController NugetArtifactController#greet() which is used to
check storage availability.
This method requires ARTIFACTS_DEPLOY role , hence choco list or nuget list command prompt for authentication.

Issue can be fixed by changing ARTIFACTS_DEPLOY to ARTIFACTS_RESOLVE or by removing auth from greet() method.

@strongbox/core-developers : Suggestions??

carlspring · 2020-02-06T19:38:21Z

~~The greet method is absolutely useless and can be removed. Will that solve your problem altogether?~~

gretel · 2020-02-06T19:40:02Z

i guess i would solve mine, too :)

steve-todorov · 2020-02-06T19:42:30Z

There's actually a comment for this in the code - the greet method is necessary because Nuget will ping it to determine if the repository is healthy or not. In this case we should probably use ARTIFACTS_RESOLVE for this case.

carlspring · 2020-02-06T19:44:46Z

Upon closer look this is actually doing something. We used to have these greet methods long before we migrated to restassured and Spring Boot which were purely for testing purposes and should have been removed a long time ago. Perhaps it would be better to rename the method to something more meaningful...(?)

gretel · 2020-02-06T19:46:01Z

btw, repository is healthy or not - how is this determined?

sbespalov · 2020-02-07T01:24:55Z

There's actually a comment for this in the code - the greet method is necessary because Nuget will ping it to determine if the repository is healthy or not. In this case we should probably use ARTIFACTS_RESOLVE for this case.

this comment also say that Nuget using this method to check that authentication required. AFAIK it will fail to deploy with ARTIFACTS_RESOLVE on this method.

sbespalov · 2020-02-07T01:39:12Z

@anki2189 can you please check it with Nuget v2 and v3 and latest mono? Also from your previous comment it's become unclear how choco determines the need for authentication?

anki2189 · 2020-02-07T04:10:06Z

choco list command fails after trying multiple times.

choco list -Source http://192.168.1.2:48080/storages/storage-nuget/nuget-releases/

Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
[NuGet] Not able to contact source 'http://192.168.1.2:48080/storages/storage-nuget/nuget-releases/'. Error was The remote server returned an error: (401) Unauthorized.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
Invalid credentials specified.
[NuGet] Not able to contact source 'http://192.168.1.2:48080/storages/storage-nuget/nuget-releases/'. Error was The remote server returned an error: (401) Unauthorized.
0 packages found.

Whereas nuget list prompts for username.

nuget list  -Source  http://localhost:48080/storages/storage-nuget/nuget-releases/              
Please provide credentials for: http://localhost:48080/storages/storage-nuget/nuget-releases/
UserName: admin
Password: ********
No packages found.

anki2189 · 2020-02-07T04:17:58Z

@anki2189 can you please check it with Nuget v2 and v3 and latest mono? Also from your previous comment it's become unclear how choco determines the need for authentication?

Behaviour is same using both nuget 2 and 3 exe.

NuGet Version: 2.8.60717.93

NuGet Version: 3.5.0.1938

Mono JIT compiler version 6.4.0.198 (2019-06/fe64a4765e6 Wed Sep 18 14:14:51 EDT 2019)
Copyright (C) 2002-2014 Novell, Inc, Xamarin Inc and Contributors. www.mono-project.com
	TLS:           
	SIGSEGV:       altstack
	Notification:  kqueue
	Architecture:  amd64
	Disabled:      none
	Misc:          softdebug 
	Interpreter:   yes
	LLVM:          yes(610)
	Suspend:       hybrid
	GC:            sgen (concurrent by default)

sbespalov · 2020-02-07T07:15:31Z

@anki2189 why choco fails with Invalid credentials specified.? Does it send any credentials?

sbespalov · 2020-02-07T07:37:33Z

I mean that we should find the root cause of why choco is not request the authentication like Nuget. Maybe it expect another Authentication Entry Point or send Authentication which is not supported by strongbox.

anki2189 · 2020-02-07T15:51:24Z

@anki2189 why choco fails with Invalid credentials specified.? Does it send any credentials?

From documentation it doesn't . https://github.com/chocolatey/choco/wiki/CommandsList

gretel · 2020-02-07T16:18:19Z

choco can send credentials on each command, this is how i work around this issue currently.

anki2189 · 2020-02-07T16:27:39Z

Also there is no Authorization header in request for choco list command.

anki2189 · 2020-02-07T16:29:13Z

choco can send credentials on each command, this is how i work around this issue currently.

By default it assumes username to be empty it not provided.

sbespalov · 2020-02-08T11:39:11Z

By default it assumes username to be empty it not provided.

@anki2189 does it requests the authentication for push command?

anki2189 · 2020-02-08T14:43:25Z

By default it assumes username to be empty it not provided.

@anki2189 does it requests the authentication for push command?

Yes, api-key

sbespalov · 2020-02-10T02:26:13Z

ok, let's try @PreAuthorize("hasAuthority('ARTIFACTS_RESOLVE')") then for greet. @anki2189 can you pelase check how Nuget push and list will work with it?

sbespalov · 2020-02-11T04:19:48Z

PR #1674 seems works fine, so I suggest to merge it and resolve the issue. Just to be clear regarding
the ARTIFACTS_DEPLOY authority, which we had on greet method before, then it probably was needed when there was no API Key authentication implemented. So since we have the API Key authentication ARTIFACTS_RESOLVE seems works fine as well.

carlspring · 2020-02-11T09:37:29Z

@gretel : Could you please test this out?

gretel · 2020-02-11T19:17:20Z

@carlspring the pipeline eats the github snapshot.. dont have any maven running :(

carlspring · 2020-02-11T19:32:42Z

@steve-todorov : Could you please take a look? Thanks!

steve-todorov · 2020-02-11T19:39:04Z

It's already in the master and on github as 1.0-SNAPSHOT. You can download the compiled version from there.

gretel · 2020-02-11T19:40:49Z

@steve-todorov ah i didnt notice the merge. can bump the deployment tomorrow. regards

gretel added the bug label Jan 30, 2020

carlspring changed the title ~~anonymous access not possible on nuget (Allow directory browsing)~~ Anonymous access not possible on nuget (Allow directory browsing) Jan 30, 2020

carlspring added the help wanted label Jan 30, 2020

steve-todorov changed the title ~~Anonymous access not possible on nuget (Allow directory browsing)~~ Cannot use choco list on nuget repositories Jan 30, 2020

anki2189 mentioned this issue Feb 8, 2020

Changing Nuget Artifact greet() Method Access Role #1674

Merged

10 tasks

carlspring closed this as completed in #1674 Feb 11, 2020

carlspring assigned anki2189 Feb 11, 2020

anki2189 mentioned this issue Feb 25, 2020

Test case for anonymous nuget list command #1685

Closed

steve-todorov mentioned this issue Mar 28, 2020

Create a chocolatey docker image #1709

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cannot use choco list on nuget repositories #1662

Cannot use choco list on nuget repositories #1662

gretel commented Jan 30, 2020 •

edited

steve-todorov commented Jan 30, 2020

gretel commented Jan 30, 2020

anki2189 commented Feb 6, 2020

gretel commented Feb 6, 2020 •

edited

anki2189 commented Feb 6, 2020 •

edited

carlspring commented Feb 6, 2020 •

edited

gretel commented Feb 6, 2020

steve-todorov commented Feb 6, 2020

carlspring commented Feb 6, 2020

gretel commented Feb 6, 2020

sbespalov commented Feb 7, 2020

sbespalov commented Feb 7, 2020 •

edited

anki2189 commented Feb 7, 2020 •

edited

anki2189 commented Feb 7, 2020

sbespalov commented Feb 7, 2020

sbespalov commented Feb 7, 2020

anki2189 commented Feb 7, 2020

gretel commented Feb 7, 2020

anki2189 commented Feb 7, 2020

anki2189 commented Feb 7, 2020

sbespalov commented Feb 8, 2020

anki2189 commented Feb 8, 2020

sbespalov commented Feb 10, 2020

sbespalov commented Feb 11, 2020 •

edited

carlspring commented Feb 11, 2020

gretel commented Feb 11, 2020

carlspring commented Feb 11, 2020

steve-todorov commented Feb 11, 2020

gretel commented Feb 11, 2020

Cannot use choco list on nuget repositories #1662

Cannot use choco list on nuget repositories #1662

Comments

gretel commented Jan 30, 2020 • edited

Bug Description

Steps To Reproduce

Expected Behavior

Environment

steve-todorov commented Jan 30, 2020

gretel commented Jan 30, 2020

anki2189 commented Feb 6, 2020

gretel commented Feb 6, 2020 • edited

anki2189 commented Feb 6, 2020 • edited

carlspring commented Feb 6, 2020 • edited

gretel commented Feb 6, 2020

steve-todorov commented Feb 6, 2020

carlspring commented Feb 6, 2020

gretel commented Feb 6, 2020

sbespalov commented Feb 7, 2020

sbespalov commented Feb 7, 2020 • edited

anki2189 commented Feb 7, 2020 • edited

anki2189 commented Feb 7, 2020

sbespalov commented Feb 7, 2020

sbespalov commented Feb 7, 2020

anki2189 commented Feb 7, 2020

gretel commented Feb 7, 2020

anki2189 commented Feb 7, 2020

anki2189 commented Feb 7, 2020

sbespalov commented Feb 8, 2020

anki2189 commented Feb 8, 2020

sbespalov commented Feb 10, 2020

sbespalov commented Feb 11, 2020 • edited

carlspring commented Feb 11, 2020

gretel commented Feb 11, 2020

carlspring commented Feb 11, 2020

steve-todorov commented Feb 11, 2020

gretel commented Feb 11, 2020

gretel commented Jan 30, 2020 •

edited

gretel commented Feb 6, 2020 •

edited

anki2189 commented Feb 6, 2020 •

edited

carlspring commented Feb 6, 2020 •

edited

sbespalov commented Feb 7, 2020 •

edited

anki2189 commented Feb 7, 2020 •

edited

sbespalov commented Feb 11, 2020 •

edited