berry: yarn npm login is not compatible with verdaccio

Describe the bug

I have a private npm registry implemented by verdaccio which requires login for any access. When a certain user does not yet exist in the registry yarn npm login succeeds. However, as soon as this user tries to relogin with the same command there’s a http error 409 (conflict).

I had reported this against verdaccio (https://github.com/verdaccio/verdaccio/issues/1737), since yarn2 login works fine for registry.yarnpkg.com. However, this was before I realized that new users may be created without problems.

To Reproduce

I’m sorry that I don’t see like I could provide the repro with Sherlock 😦

1 You would have to install verdaccio, globally or locally, with yarn or npm and run it like this [yarn run] verdaccio -c conf.yml with this conf.yml:

storage: ./storage

auth:
  htpasswd:
    file: ./htpasswd

security:
  api:
    jwt:
      sign:
        expiresIn: 30d
        notBefore: 0
  web:
    sign:
      expiresIn: 7d

uplinks:
  npmjs:
    url: https://registry.npmjs.org/

packages:
  '@*/*':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs

  '**':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs

logs:
  - {type: file, path: verdaccio.log, level: trace}

2 Furthermore I save this as .yarnrc.yml (you’d have to correct yarnPath, obviously)

yarnPath: "...\\.yarn\\releases\\yarn-berry.js"

unsafeHttpWhitelist:
  - "localhost"

npmRegistryServer: "http://localhost:4873"

3 Execute yarn npm login two times - the first will succeed, the second fail with a message like this:

➤ YN0001: HTTPError: Response code 409 (Conflict) at EventEmitter. (…\releases\yarn-berry.js:24:327728) at processTicksAndRejections (internal/process/task_queues.js:97:5) ➤ YN0000: Failed with errors in 4.09s

Environment if relevant (please complete the following information):

  • OS: [e.g. OSX, Linux, Windows, …] windows 10
  • Node version [e.g. 8.15.0, 10.15.1, …] 12.16.1
  • Yarn version [e.g. 2.0.0-rc1, …] 2.0.0rc29
const cp = require('child_process')
const fs = require('fs')


const verdaccioConf=`
storage: ./storage

auth:
  htpasswd:
    file: ./htpasswd

uplinks:
  npmjs:
    url: https://registry.npmjs.org/

packages:
  '@*/*':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs

  '**':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs

logs:
  - {type: stdout, format: pretty, level: http}
`
fs.writeFileSync('config.yaml', verdaccioConf)


const htpasswd = `
test:$6FrCaT/v0dwE:autocreated 2020-06-09T16:43:43.706Z
`
fs.writeFileSync('htpasswd', htpasswd)


const  yarnrc = `
unsafeHttpWhitelist:
  - "localhost"

npmRegistryServer: "http://localhost:4873"
`
fs.writeFileSync('.yarnrc.yml', yarnrc)


await packageJsonAndInstall({
  dependencies: {
    'verdaccio': '4.5.1'
  }
})

cp.spawn('./node_modules/.bin/verdaccio')

await new Promise(resolve => setTimeout(resolve, 5000)) // a bit of a delay

const output = await yarn('yarn', 'npm', 'login') // test, test
expect(output).not.toContain('Response code 409 (Conflict)')

About this issue

  • Original URL
  • State: closed
  • Created 4 years ago
  • Reactions: 11
  • Comments: 26 (5 by maintainers)

Commits related to this issue

Most upvoted comments

Temporary workaround:

  1. Login with NPM
  2. Copy-paste generated token from ~/.npmrc to ~/.yarnrc.yml.
❯ cat ~/.npmrc
//npm.my-project.pro/:_authToken="GAOEuaeouaoEUo+u3=="

❯ cat ~/.yarnrc.yml
npmRegistries:
  "https://npm.my-project.pro":
    npmAuthToken: GAOEuaeouaoEUo+u3==

Then yarn npm publish for verdaccio works fine.

Feel like I’m late to the party but discovering this issue in 2023. 😆

I was able to reproduce this easily with Yarn 2.0.0-rc.31. I ran verdaccio via the default Docker image:

$ docker run -it --rm --name verdaccio -p 4873:4873 verdaccio/verdaccio

Then first create a user via:

$ npm adduser --registry http://localhost:4873

Then configure the local registry in your .yarnrc.yml file:

npmScopes:
  testscope:
    npmPublishRegistry: "http://localhost:4873"
    npmRegistryServer: "http://localhost:4873"
    npmAlwaysAuth: true
unsafeHttpWhitelist:
  - "localhost"

followed by:

$ yarn npm login -s testscope

If you use the same credentials from adduser, the yarn login will fail and you will see the following error message from the Verdaccio process:

http <-- 409, user: null(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ringods', error: username is already registered

Same issue

I designed a temporary fix.

I created a file named .yarn/publish.sh in which I change the version of Yarn on the fly in the .yarnrc.yml. This allows to publish with the 1.22.10 version and to switch back to the “Berry” version of Yarn.

# This is a temporary fix allowing to publish the package.
# Indeed, there is a bug under Yarn Berry that prevents deployment on Verdaccio.
# @see https://github.com/yarnpkg/berry/issues/1044
# @see https://github.com/verdaccio/verdaccio/issues/1737
sed -i "s/yarnPath: .*/yarnPath: \.yarn\/releases\/yarn-1.22.10.cjs/" .yarnrc.yml
yarn publish
sed -i "s/yarnPath: .*/yarnPath: \.yarn\/releases\/yarn-berry.cjs/" .yarnrc.yml

When you want to publish, do not run yarn npm publish, but rather ./.yarn/publish.sh.

Same issue with yarn 3.1.1 here and Verdaccio 3.2.0, but I can confirm that the workaround of @korniychuk works.

After playing with Wireshark, a non-https request and Yarn Berry I was able to replicate the same behavior on Postman.

It looks like yarn npm login is not adding the Authorization header but just the user and password in the body request. For whatever reason, that’s making verdaccio not use the authorization process but the adduser process.

As extra info, it doesn’t launch the authorization nor the adduser process from all the plugins as I’m using verdaccio-azure-ad-login and this one does not display any of the debug messages it displays when using npm login.

I’ll give it a try 🤞

BTW, if I copy the auth-token received by “npm login” into .yarnrc.yml the registry can be accessed without probs.