File download with wget only works with auth-no-challenge argument

it_9582

Hi there,
today I want to implement a file download over a toolkit which we use in our development process. This toolkit (which runs on linux) will download files from the server (now ProGet) over wget. The username and password will be used from wget over a .netrc file.

If I run a download of a file (I tested asset download and pypi-package download) with wget the ProGet-Server will response with 401 Unauthorized.

---response end---
401 Unauthorized
Registered socket 3 for persistent reuse.
Skipping 105 bytes of body: [You are not authorized to perform the Feeds_DownloadPackage task on this feed anonymously. Please log in.] done.
Unknown authentication scheme.

Username/Password Authentication Failed.

If I add the argument --auth-no-challenge to the wget call than the download will finish successfully but I this is more a workaround for this issue. As a side note the download of the same file over curl run without any issues and without extra arguments.

Are there any possibilities to fix this issue?

Best regards.

atripp

Hi @it_9582 ,

Unfortunately I'm not really sure what your script is doing or how to fix it... but I will describe the server (ProGet) behavior.

Unless you allow Anonymous access on the endpoint, ProGet will respond with a 401 when you access a URL without any authentication information (API Key header, Basic credentials). That's what the message you are sharing appears to do.

So if you're getting that message, then I guess the username/password isn't being sent? I really don't know what --auth-no-challenge means or does.

Thanks,
Alana

it_9582

Hi @atripp,
thanks for your fast answer.

Our script only downloads files from the ProGet-Server with wget on Linux and username:password (cannot be changed as simple). As we are using the API-Keys to authenticate with the server, so the wget call is the following:

wget --user api --password <api-key> <Download path>

After running this command I get a 401 from the Server. If I add the --auth-no-challenge argument like in the following snipped:

wget --user api --password <api-key> --auth-no-challenge <Download path>

than the Download runs without any issues.

The download also works without the --auth-no-challenge argument if I allow the download for Anonymous users.

I also checked if a download works if I send the Auth-Header manually with wget.

# generate base64 Encode Credentials
echo -n 'api:<key>' | base64

wget --header="Authorization: Basic <base64 Credentials>" <Download path>

This works also without any issues.

atripp

Hi @it_9582 ,

Thanks for the additional information.

The reason this is happening is because these endpoints do not return a WWW-Authenticate: Basic ... header value when responding with 401.

This behavior intentional, as our preferred authentication is using an API Key header value, not Basic credentials. Basic is an alternative option and can be used when you can't easily pass a header.

We are not willing/able to change this behavior, as it would require changing code on a substantial number of endpoints and may break user integrations that have been relying on existing behavior.

So I'm afraid this means you'll need to do one of the following:

add the --auth-no-challenge option
use wget --header="X-ApiKey: <api-key>" "<Download path>" instead
use curl instead
use pgutil instead

Cheers,
Alana

it_9582

Hi @atripp,

thanks for the explanation.
I can understand that you are not willing/able to change this behavior. Now I will check if it is possible for us to modify the underlying wget call to allow downloading of the files from ProGet.

Best regards