strongbox: Cannot use choco list on nuget repositories

Bug Description

The default configuration has ANONYMOUS_ROLE set but trying to browse a nuget directory does always require authentication.

Steps To Reproduce

Deploy strongbox using default configuration
Enable “Allow directory browsing” in nuget-storage
Try to do any api transaction anonomously (like choco list)

Expected Behavior

Anonoymous users should be able to browse the directory as inherited by ARTIFACTS_RESOLVE

Environment

Strongbox Version: {"strongbox":{"version":"1.0-SNAPSHOT","revision":"eccd13064b1e3bfa"}}
OS: adoptopenjdk/openjdk8:jdk8u232-b09-alpine

About this issue

Original URL
State: closed
Created 4 years ago
Comments: 29 (22 by maintainers)

Most upvoted comments

There’s actually a comment for this in the code - the greet method is necessary because Nuget will ping it to determine if the repository is healthy or not. In this case we should probably use ARTIFACTS_RESOLVE for this case.

steve-todorov on Feb 6, 2020

There is a method in NugetArtifactController NugetArtifactController#greet() which is used to check storage availability. This method requires ARTIFACTS_DEPLOY role , hence choco list or nuget list command prompt for authentication.

Issue can be fixed by changing ARTIFACTS_DEPLOY to ARTIFACTS_RESOLVE or by removing auth from greet() method.

@strongbox/core-developers : Suggestions??

anki2189 on Feb 6, 2020

@steve-todorov ah i didnt notice the merge. can bump the deployment tomorrow. regards

gretel on Feb 11, 2020

PR #1674 seems works fine, so I suggest to merge it and resolve the issue. Just to be clear regarding the ARTIFACTS_DEPLOY authority, which we had on greet method before, then it probably was needed when there was no API Key authentication implemented. So since we have the API Key authentication ARTIFACTS_RESOLVE seems works fine as well.

sbespalov on Feb 11, 2020

choco can send credentials on each command, this is how i work around this issue currently.

gretel on Feb 7, 2020

@steve-todorov choco list should be possible anonymously.

gretel on Jan 30, 2020