Proget: docker login returns unauthorized

mattworley_6429

Hi there

I've just run a fresh install of proget and I'm having real problems with "docker login". I've tried a whole load of configurations with both Proget 5.0.4 and Proget 4.8.8 but nothing works. Here are steps to replicate with a fresh install of Proget 5.0.4 (running in Docker) without any permissions or accounts being played with:

Activate Proget
Create a new container feed.
From your terminal run "docker login -u Admin -p Admin host.name.net"

The result is always:

Error response from daemon: login attempt to https://host.name.net/v2/ failed with status: 401 Unauthorized

Browsing to https://host.name.net/v2/ (while logged in via the browser as Admin) returns:

code "UNAUTHORIZED"
message "Anonymous is not permitted to perform the Feeds_ViewFeed task for the current scope."

As a temporary work around I've found that I can create an auth token with:

echo -n 'Admin:Admin' | base64

And add that to my local docker instance's config.json, but that only works locally and is no use in CI environments etc.

Many thanks
Matt

Product: ProGet
Version: 5.0.4

mattworley_6429

Actually the base64 token creation and editing config.json doesn't work locally either - please ignore that part.

mattworley_6429

Sorry to spam, but further to this, if I deliberately use an incorrect password with docker login I get this message:

Error response from daemon: Get https://myhost.net/v2/: denied: requested access to the resource is denied

If I use the correct password I get:

Error response from daemon: login attempt to https://myhost.net/v2/ failed with status: 401 Unauthorized

So I must have some screwed up permissions somewhere, but as mentioned this is just a vanilla deployment of the proget docker image. I had this working before with no issues (though likely with an earlier version if that could be making the difference).

I have NPM and NuGet feeds running and connecting with no issues on the same instance.

Please help me! :)

Thanks
Matt

mattworley_6429

OK, if I roll back to 4.7.14 the Docker client will login with no issues.

ben

Hello Matt,

Is Web.BaseUrl set to https://host.name.net in https://host.name.net/administration/advanced-settings? Is there a reverse proxy between ProGet and the internet that requires authentication, or that might be modifying authentication headers?

If you access the /v2/ URL in your browser, there should be a header like WWW-Authenticate: Bearer realm="https://host.name.net/v2/_auth",service="host.name.net".

EDIT: We have updated our Docker documentation to include this information and more information about setting up your Docker client and ProGet server.

mattworley_6429

Hi Ben, thanks for your reply and sorry for the delay in getting back to you.

I just spun up a new docker instance of Proget 5.0.6 and tested again.

Web.BaseUrl was empty, but updating it to contain the full host did not fix docker login.

There is an nginx proxy in front of Proget in my setup. The following proxy settings are in the nginx config:

location / {
    proxy_pass http://127.0.0.1:5080;
    proxy_redirect off;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Protocol $scheme;
    proxy_set_header X-Url-Scheme https;
    proxy_set_header X-Forwarded-Host $host:443;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-Ssl on;
    proxy_set_header X-Forwarded-Port 443;
}

I can confirm that the WWW-authenticate header is returned and correct when browsing /v2/.

As mentioned above, I have no problems when falling back as far as 4.7.14 so this appears to be a regression?

Many thanks,
Matt

Guest

There was a regression in v5.0.6 with Docker Registries, but it's been upated now in v5.0.7, and it should work now.

mattworley_6429

Hi, just tested with Proget 5.0.8 and the issue persists.

ben

Hello Matt,

What version of Docker do you have installed? As of ProGet 4.8.2, we require Docker 1.11.0 or newer because we use token authentication (PG-1059).

Guest

Hi everyone,

I'am currently using ProGet v5.0.12 on Windows server 2016 with IIS, and https enable (443) but i'am not able to push a single docker image on my repo.

I have docker v17.12.1-cs installed on an Ubuntu 18.04 LTS, and when i push the image, the download initialized, and then i get the error:
"requested URL /v2/(my-repo)/(my-image)/blobs/uploads/ was not found on this server."

Is there any way to redirect into IIS, all the requests for /v2/(my-repo) ? or to specify on docker client the api (or not) to use when pushing ?

Thx

Guest

Hello Everone,

Having the same issue as Matt.

We are on Proget 5.0.12 (was on 5.0.11) and using Docker Version 18.05.0-ce-win66 (17760) Channel: edge
On Win 2016, IIS with HTTPS binding and explicit host name (e.g. FQDN) is specified. CA cert is used as well.
Perfect Forward Secrecy script was also run on the server with TLSv1.0/1.1/1.2 enabled. Will be removing everything except TLSv1.2 shortly.

Using IIS with Integrated Windows Auth and I has been working for some time over multiple version of Proget, however, never tried Docker or /v2/ before. Now that we are looking into private Docker registry, need some help...

Navigating to https://FQDN/v2/ in a browser causes 401 when I provide valid credentials and I do see WWW-Authenticate header:

WWW-Authenticate: Bearer realm="https://FQDN/v2/_auth", service=FQDN, Negotiate, NTLM

@Sebastian
Are you using Integrated Authentication? Also, are you saying you have authentication working for you, but cannot push? Could you navigate in your browser to https://yourFQDN/v2/ with trailing slash?

Thanks,
Vitalii

Guest

Oddly, looking into another issue just now I was able to login via Docker but still get 401 when accessing new url (https://FQDN1/v2/) via browser.

I was trying to expose some feeds to Anonymous Users, so went with one of your suggestions here.

Note the URL is different than Integrated Auth URL, https://FQDN/v2/ vs https://FQDN1/v2/ with later being configured with Anonymous Auth and working. Docker still prompts me for credentials and when I enter correct credentials login succeeds, If I provide incorrect creds login fails with unauthorized: authentication required error.

Also, if I use Forms Auth instead of Integrated, then Visual Studio package management will not work. Team City Build Server most likely will have an issue as well (I haven't tried API Key option yet).

At last, we are using LDAP user directory and haven't tried Active Directory (New) option.

Hope this is enough details for you to guide me in the right direction.

Thanks in advance,
Vitalii

Guest

Hi Vitalii,

About the authentification, i give the right to anonymous to push / publish in the task tab (Administration > Security). I will create a group later, but i wanted to check if it works properly for containers as for NPMs and NuGets packages.

On IIS i use an Auto Signedin certificate without windows authentification.

About the docker push i got these messages:

the push refers to repository (my-repo)*
hashes of every layers: Preparing
error 404: The requested URL /v2/(my-repo)/(my-image)/blobs/uploads was not found on this server

I tries from my browser https://(my-repo)/v2/ and i got the same error message 404

Guest

Hello,

I'm having the same issue as Matt, i can sucessfully push a docker image to Proget 4.7.14 but not to Proget 5.1.15 (unauthorized error 401).
Here is my setup:

Docker host version 17.05.0-ce
Proget version 5.1.15
PostgresSQL 9.5

I'm pushing images from debian vm with docker 18.06.1-ce.
Can you help me ?

mattworley_6429

Hey, weirdly I just revisited this last week. I had the same issues on trying to upgrade but found the fix.

Go to Settings > Advanced Settings and set Web.BaseUrl to your Proget URL e.g https://registry.example.com

Worked for me. Good luck.

Cheers
Matt

mattworley_6429

Actually - setting the WebUrl was advised by Ben above! Not sure what changed between then and now, but it works for me now.
Cheers,
Matt

Guest

Hello,

Thanks for the tip, unfortunately i still have the same issue.
To make a clarification on my issue; when i use docker login with wrong creds i get "denied: requested access to the resource is denied" and with good creds " failed with status: 401 Unauthorized".
I will try a setup without nginx-proxy in front of Proget container.

Regards.

Guest

Any update on this.
Have the same setup - nginx as a reverse proxy to proget.
And the same issue "401 Unauthorized" when performing docker login.
BaseUrl is configured. If wrong credentials are passed to docker login message changes to "Get https://nuget.my.domain/v2/: denied: requested access to the resource is denied"

SSL cert s issued with letsencrypt and valid
Docker version 18.09.1, build 4c52b90

Guest

Hi,

I still have the same issue on latest builds (tested this week)
Only image inedo/proget:4.7.14 work for me with my setup.

Regards.

Guest

Exact same issue here, running 5.1.23 as a docker image on a Debain 8 host behind nginx as a reverse proxy and for SSL termination using a lets encrypt certificate.

Was working fine before the weekend, was able to push up a docker image, and pull it down on a server, but I came in this morning and am now getting the same authentication issues "Error response from daemon: login attempt to https://host.domain/v2/ failed with status: 401 Unauthorized" using valid credentials and "Error response from daemon: Get https://host.domain/v2/: denied: requested access to the resource is denied" if I use invalid credentials.