JFrog Artifactory 间歇性拒绝身份验证，403 被禁止

Posted 2023-02-22

技术标签:

【中文标题】JFrog Artifactory 间歇性拒绝身份验证，403 被禁止【英文标题】：JFrog Artifactory intermittently rejects authentication with 403 forbidden 【发布时间】：2020-05-28 12:23:30 【问题描述】：

由于一些“身份验证”问题，我很难配置 zypper 客户端（SLES 和 OpenSUSE）以在 JFrog 中使用我们的 RPM Repository。起初，我认为这只是 zypper 和 opensuse 的问题，所以我首先专注于我们努力让 zypper 工作。 This 是上一个问题。

但是yum 客户端 (centOS) 也会时不时出现这些与身份验证相关的错误，尽管不是那么频繁。

所以我尝试使用man-in-the-middle 来看看幕后发生了什么，这是zypper 的序列：

场景 1 - 认证成功

以下是zypper refresh --repo myrepo的序列：

(1) zypper 发送带有base64 编码的username: 的HTTP HEAD 请求：

HEAD /myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml HTTP/1.1
Host: rpm.example.com
Authorization: Basic dXNlcm5hbWU6
User-Agent: ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
Accept: */*
Connection: close

(2) jfrog 响应 HTTP 401 Unauthorized 并带有 WWW-Authenticate 标头：

HTTP/1.1 401 Unauthorized
Date: Thu, 28 May 2020 08:20:04 GMT
Content-Type: application/json;charset=ISO-8859-1
Connection: close
Server: Artifactory/7.4.3 70403900
X-Artifactory-Id: 2148103ba10eacbb:-16f1c4c1:172093a231a:-8000
X-Artifactory-Node-Id: artifactory-server
WWW-Authenticate: Basic realm="Artifactory Realm"

(3) zypper 发送另一个 HTTP HEAD 请求，这次使用base64 编码的username:password：

HEAD /myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml HTTP/1.1
Host: rpm.example.com
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
User-Agent: ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
Accept: */*
Connection: close

(4) jfrog 最终以 HTTP 200 响应。

HTTP/1.1 200 OK
Date: Thu, 28 May 2020 08:20:04 GMT
Content-Type: application/xml
Content-Length: 1394
Connection: close
Server: Artifactory/7.4.3 70403900
X-Artifactory-Id: 2148103ba10eacbb:-16f1c4c1:172093a231a:-8000
X-Artifactory-Node-Id: artifactory-server
Last-Modified: Fri, 08 May 2020 10:25:19 GMT
Accept-Ranges: bytes
X-Artifactory-Filename: repomd.xml
Cache-Control: no-store

这些由 Artifactory 记录：

artifactory-request.log:

2020-05-28T08:20:34.566Z [5f78297c2aeabaa8] [DENIED LOGIN]   for client : username / 213.1.1.1. 
2020-05-28T08:20:34.870Z [570978212a5318e3] [ACCEPTED DOWNLOAD] myapp-release-rpm-cache:stable/myapp/2019/3/repodata/repomd.xml  for client : username / 213.1.1.1.

artifactory-access.log:

2020-05-28T08:20:34.566Z|5f78297c2aeabaa8|213.2.2.2|non_authenticated_user|HEAD|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|401|-1|0|8|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
2020-05-28T08:20:34.721Z|8018b7cbc9c424e8|213.2.2.2|username|HEAD|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|200|-1|1394|3|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
2020-05-28T08:20:34.870Z|570978212a5318e3|213.2.2.2|username|GET|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|200|-1|1394|2|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
...

所以基本上，zypper 带有 HEAD 请求，JFrog 说“你没有通过身份验证”，zypper 回复并尝试进行身份验证，最后 JFrog 对 zypper 进行身份验证。到目前为止是有道理的。

场景 2 - 403 禁止

做一些工作，几分钟后运行同样的zypper refresh --repo myrepo 命令，结果如下：

(1) zypper 发送带有base64 编码的username: 的HTTP HEAD 请求：

HEAD /myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml HTTP/1.1
Host: rpm.example.com
Authorization: Basic dXNlcm5hbWU6
User-Agent: ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
Accept: */*
Connection: close

(2) jfrog 响应 HTTP 401 Unauthorized 并带有 WWW-Authenticate 标头：

HTTP/1.1 401 Unauthorized
Date: Thu, 28 May 2020 08:30:44 GMT
Content-Type: application/json;charset=ISO-8859-1
Connection: close
Server: Artifactory/7.4.3 70403900
X-Artifactory-Id: 2148103ba10eacbb:-16f1c4c1:172093a231a:-8000
X-Artifactory-Node-Id: artifactory-server
WWW-Authenticate: Basic realm="Artifactory Realm"

(3)zypper 发送另一个 HTTP HEAD 请求，这次使用base64 编码的username:password：

HEAD /myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml HTTP/1.1
Host: rpm.example.com
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
User-Agent: ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
Accept: */*
Connection: close

(4) 这一次，jfrog 回复 403 Forbidden 而不是 200 OK。

HTTP/1.1 403 Forbidden
Date: Thu, 28 May 2020 08:30:44 GMT
Content-Type: application/json;charset=ISO-8859-1
Connection: close
Server: Artifactory/7.4.3 70403900
X-Artifactory-Id: 2148103ba10eacbb:-16f1c4c1:172093a231a:-8000
X-Artifactory-Node-Id: artifactory-server
WWW-Authenticate: Basic realm="Artifactory Realm"

artifactory-request.log:

2020-05-28T08:30:44.496Z [46c81a2450623166] [DENIED LOGIN]   for client : username / 213.1.1.1.
2020-05-28T08:30:44.630Z [769ed41c652daa7a] [DENIED LOGIN]   for client : username / 213.1.1.1.

artifactory-access.log:

2020-05-28T08:30:44.496Z|46c81a2450623166|213.2.2.2|non_authenticated_user|HEAD|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|401|-1|0|9|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
2020-05-28T08:30:44.630Z|769ed41c652daa7a|213.2.2.2|non_authenticated_user|HEAD|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|403|-1|0|1|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64

请注意，当要求进行身份验证时，zypper 发送相同的 Authorization 标头值，但在第二种情况下，JFrog 无法对请求进行身份验证。

以前有人对 JFrog 有过同样的问题吗？我们猜测这是 JFrog 7 的问题，因为我们的刚刚升级，但我们无法验证这一点。不幸的是，我们采用的是付费计划，甚至没有支持许可证。

非常感谢任何建议和cmets。

其他信息

可能值得注意的是，yum 客户端（centos 和 rhel）与 JFrog Artifactory 没有这个确切的问题，这很可能是因为 yum 总是在 HTTP 标头中发送用户名和密码哈希，避免了401 Unauthorized重新认证序列。

JFrog Artifactory 间歇性拒绝身份验证，403 被禁止

场景 1 - 认证成功

场景 2 - 403 禁止

其他信息

更多详情