Maven http.authentication.preemptive与Artifactory的对抗

Question

从我的Artifactory服务器上下载“受保护的”工件时，我遇到了巨大的困难。有人能确认下面的(maven) settings.xml摘录足以导致GET请求抢先携带身份验证信息吗？

Maven 3.3.9。Artifactory 4.4.2。

<servers>
<server>
  <id>myServerId</id>
  <username>myUserId</username> 
  <password>myPlainTextPassword</password>
  <configuration>
     <httpConfiguration>
        <all>
           <params>
              <property>
                 <name>http.authentication.preemptive</name>
                 <value>%b,true</value>
              </property>
           </params>
        </all>
     </httpConfiguration>
  </configuration>
</server>
</servers>

谢谢,

罗宾

Maven输出：

C:\>mvn -U clean package
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Building fc 1.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
Downloading: http://repo.myserver.co.uk/artifactory/libs-release/com/group/artifact/126/artifact-126.pom
Downloading: http://www.license4j.com/maven/com/group/artifact/126/artifact-126.pom
Downloading: http://repo.myserver.co.uk/artifactory/private-local/com/group/artifact/126/artifact-126.pom
Downloading: https://repo.maven.apache.org/maven2/com/group/artifact/126/artifact-126.pom
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 3.906 s
[INFO] Finished at: 2016-01-31T19:41:52+02:00
[INFO] Final Memory: 8M/245M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal on project fc: Could not resolve dependencies for project uk.co.myserver:fc:jar:1.0-SNAPSHOT: Failed to collect dependencies at com.group:artifact:jar:126: Failed to read artifact descriptor for com.group:artifact:jar:126: Could not transfer artifact com.group:artifact:pom:126 from/to releases (http://repo.myserver.co.uk/artifactory/libs-release): Access denied to: http://repo.myserver.co.uk/artifactory/libs-release/com/group/artifact/126/artifact-126.pom , ReasonPhrase:Forbidden. -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionException

Artifactory访问日志：

2016-02-01 11:14:33,562 [DENIED DOWNLOAD] libs-release:com/group/artifact/126/artifact-126.pom for anonymous/193.66.174.253.
2016-02-01 11:14:33,564 [DENIED DOWNLOAD] private-release-local:com/group/artifact/126/artifact-126.pom for anonymous/193.66.174.253.
2016-02-01 11:14:34,436 [ACCEPTED DELETE] libs-release:com/group/artifact/126/artifact-126.pom for anonymous/193.66.174.253.
2016-02-01 11:14:35,010 [DENIED DOWNLOAD] private-local:com/group/artifact/126/artifact-126.pom for anonymous/193.66.174.253.
2016-02-01 11:14:35,011 [DENIED DOWNLOAD] private-release-local:com/group/artifact/126/artifact-126.pom for anonymous/193.66.174.253.
2016-02-01 11:14:35,012 [ACCEPTED DELETE] private-local:com/group/artifact/126/artifact-126.pom for anonymous/193.66.174.253.

下面所有的username/password/http.authentication.preemptive参数在pom.xml和settings.xml中都是一样的，因为它们都引用相同的Artifactory服务器，所以它们共享相同的Artifactory参数：

<id>releases</id>
<id>snapshots</id>
<id>private-local</id>
<id>plugin-releases</id>
<id>plugin-snapshots</id>
<id>deploy-releases</id>
<id>deploy-snapshots</id>

只有以下内容在settings.xml中没有提到，因为访问应该是匿名的，并且它是其他人服务器上的一个单独的存储库实例：

<id>license4j-runtime-library</id>

以下是请求日志的相应输出：

20160202060102|58|REQUEST|193.66.174.253|admin|GET|/ui/systemlogs/logData|HTTP/1.1|200|0
20160202060102|1099|REQUEST|199.19.249.196|anonymous|GET|/libs-release/com/group/artifact/126/artifact-126.pom|HTTP/1.1|401|0
20160202060102|706|REQUEST|199.91.135.165|anonymous|GET|/libs-release/com/group/artifact/126/artifact-126.pom|HTTP/1.1|401|0
20160202060102|5|REQUEST|193.66.174.253|anonymous|GET|/libs-release/com/group/artifact/126/artifact-126.pom|HTTP/1.1|401|0
20160202060103|3|REQUEST|199.19.249.196|anonymous|GET|/private-local/com/group/artifact/126/artifact-126.pom|HTTP/1.1|401|0
20160202060103|3|REQUEST|193.66.174.253|anonymous|GET|/private-local/com/group/artifact/126/artifact-126.pom|HTTP/1.1|401|0
20160202060113|60|REQUEST|193.66.174.253|admin|GET|/ui/systemlogs/logData|HTTP/1.1|200|0

请注意，有两个对private-local的请求，这两个请求都是“匿名”的。使用抢占式身份验证时，我会认为所有这些都是"myUserId“。

Answer 1

你对你的匿名用户在Artifactory上有什么权限？

在Artifactory --> Admin --> Security --> General -->上是否选中了“隐藏未授权资源的存在”复选框？

除此之外，您还可以粘贴request.log中的相关部分吗？

Answer 2

在执行代理时，服务器的httpConfiguration必须为：

<server>
    <id>**********</id>
    <username>**********</username>
    <password>**********</password>
    <configuration>
        <httpConfiguration>
          <all>
            <usePreemptive>true</usePreemptive>
          </all>
        </httpConfiguration>
    </configuration>
</server>