Reference / schema loading problem behind kerberos authenticated proxy

[fis-cz]

Hello,

I have problem loadind JSON references / schemas behind corporate kerberos authenticated proxy.

VS Code reports:

Problems loading reference 'https://schemastore.azurewebsites.net/schemas/json/tsconfig.json'
Unable to load schema from 'https://schemastore.azurewebsites.net/schemas/json/tsconfig.json'

or

Unable to load schema from 'http://json.schemastore.org/tslint'

Followed by the HTML error message returned by the proxy server itself: Authentication required

The rest of features of VSC are working fine (extension/market place browsing) so I think that some specific method is used to load references from the web and the Chromium proxy settings are not used.

Please note there is not fallback to NTLM or Basic authentication allowed on the proxy server, just kerberos.

Version: 1.38.1 (system/user),
I notice the problem is there at least since 1.26.

I didn't find any other related issue and I think this one is not covered by #79044 or by #74991.

[vscodebot]

(Experimental duplicate detection)
Thanks for submitting this issue. Please also check if it is already covered by an existing one, like:

• [json] schema not loading behind working proxy everything else works fine (#74991)
• Adding/Updating json schema programmatically from third party plugin (#79363)

[ee-github]

To confirm layman's understanding, will this issue prevent JSON schema validation from behind any common Kerberos-only corporate proxy?

If so, here is a vote to prioritize a fix.

Observation: In my case the connect error message in "PROBLEMS" points to where the schema resides (not the IP of the proxy server). This suggests the proxy was not even used, as in a proxy setup the client never needs the IP of the actual destination. Unless there is functionality to fall back to a direct connection in the event that proxy auth fails?

[chrmarti]

We have added Kerberos support for proxies a while back. Could you confirm this still being an issue? Thanks.

[ee-github]

It is NOT still an issue locally on Windows. Details: After more testing, this presents itself when using VSCode on Windows while working (remote development) on a Linux host.

I was under the assumption that it was the Window VS Code client that is responsible for pulling the schema from a remote location. However, it seems it's the "vscode server" on the remote Linux host that initiates the connection to pull the remote schema file (confirmed by firewall drop logs).

Under Setting -> Remote [SSH: hostname] -> Application -> Proxy I found a "Proxy" field. Entering a proxy there that the remote Linux server can access fixes the JSON schema validation functionality.

It would be nice if there was a way for the Windows VSCode client to fetch the remote schema as in general it will run on a corp machine with all the right settings and auth, while remote dev servers might be all over the place. Does this functionality exist? It seems that this does work for installing remote extensions (and the vscode server itself) but maybe not for the JSON schema validation functions?

[chrmarti]

@aeschli Over to you for consideration of fetching JSON schemas locally when they can't be fetched on the remote.

[aeschli]

@chrmarti We need to solve this in VS Code remote itself. We can't ask every extension that wants to make http/s requests to be aware that they run remotely and ask them to find a way to forward that request to the local side.

Sorry, I don't know what needs to be configured for kerberos. Can it be done with the `http.proxy' settings on the remote?

• on the remote machine setting you can use the http.useLocalProxyConfiguration in get the local settings for http proxies
• also, can't this be configured in the WSL distro itself, e.g. by setting the `http_proxy' env variables?