Proget: docker login returns unauthorized

Guest

Exact same issue here, running 5.1.23 as a docker image on a Debain 8 host behind nginx as a reverse proxy and for SSL termination using a lets encrypt certificate.

Was working fine before the weekend, was able to push up a docker image, and pull it down on a server, but I came in this morning and am now getting the same authentication issues "Error response from daemon: login attempt to https://host.domain/v2/ failed with status: 401 Unauthorized" using valid credentials and "Error response from daemon: Get https://host.domain/v2/: denied: requested access to the resource is denied" if I use invalid credentials.

ben

Here's what I currently have that is working; I'm running ProGet 5.2.0 on Windows with the self-hosted (non-IIS) web server. SSL is using Let's Encrypt; nginx is running on a Linux machine.

server {
        include /etc/nginx/lubar.me-shared.conf;
        server_name proget.local.lubar.me;
        server_name proget.lubar.me;

        # CSP header removed for brevity; irrelevant to this issue

        client_max_body_size 0; # disable any limits to avoid HTTP 413 for large image uploads

        # required to avoid HTTP 411: see Issue #1486 (https://github.com/dotcloud/docker/issues/1486)
        chunked_transfer_encoding on;

        location / {
                if ($lan_ip = 0) {
                        limit_rate_after 200k;
                        limit_rate 50k;
                }

                proxy_pass http://proget-upstream;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $http_host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection $http_connection;
                proxy_set_header Accept-Encoding '';
                proxy_hide_header X-AspNet-Version;
                proxy_http_version 1.1;
                proxy_buffering off;
                proxy_request_buffering off;
                proxy_connect_timeout 1m;
                proxy_read_timeout 1h;
                proxy_send_timeout 1h;
        }
}

It looks like the current issue people are facing might be related to something specific to the Docker version of ProGet. I will investigate this.

Guest

Ben, I can confirm the issue doesn't seem to be related to nginx as I still get the same errors when trying to connect to the container itself directly.

Guest

FYI: I'm running the exactly same version of ProGet with the exact same nginx config and it's working fine for me

itpurchasing_9346

We had the same issue suddenly rear its head out of no where.

We were running ProGet 5.1.22 for a long time with no issues. Then all the sudden we started getting 401 unauthorized responses for docker login attempts.

The suggested fixes have no effect.

I thought it might be a compatibility issue, and upgraded ProGet to 5.2.23 - no fix.

We're running docker 19.03.2.

itpurchasing_9346

@ben - Any movement on the potential cause being a Docker version within ProGet?

markcodyre_7146

Thanks Matt,

Really hope Proget creates better documentation around setting up Proget with a nginx proxy in front of it (the current documentation is pretty useless). I've wasted an entire evening trying to figure this out. I almost gave up and went back to using Nexus3.

Matts fix where he went to 'Settings > Advanced Settings' and set the 'Web.BaseUrl' to your Proget URL e.g https://registry.example.com worked fro me.

I was able to get it working nicely with this proxy in front of it.
https://github.com/evertramos/docker-compose-letsencrypt-nginx-proxy-companion

Along with Jenkins, and my other dev tooling services.

Regards,

Mark

apxltd

Our (paying) customer hardly ever configures ProGet in this manner, and we aren't exactly Linux experts so writing documentation on seemingly dozens of different ways on how to do this sort of thing is really tough for us.

I'd very much welcome your contribution to our documentation, it's on GitHub (just click "Propose an Edit" at the bottom): https://docs.inedo.com/docs/proget/installation/installation-guide/linux-docker

I want ProGet to be a great community tool, and hope you can help contribute to the Linux installation experience; thanks!

markcodyre_7146

@apxltd After re-reading my post I think I was a bit harsh, sorry. Proget really is a great tool and I love what Inedo has done with it up to this point. The documentation is quite good as I've referenced it quite a few times and found it helpful. Just found to be lacking where I had got stuck (and my frustration got the best of me). I shouldn't complain as it's trial option is free with heavy hitting features; Enough to really test it out. I'll make a note to create a page on how to set this up on a Linux box when I have some downtime.
Thanks!

apxltd

@markcodyre_7146 thanks for the note Mark, I appreciate it! Glad it's working well, despite the challenging install - we've got a lot of great container features in the pipeline, so hopefully we'll learn more about Linux in the process ;)

araxnid_6067

@apxltd @ben
Hello, we faced with same problem. Docker can't login to docker repository

docker login proget.company.com

return this message

Error response from daemon: login attempt to https://proget.company.com/v2/ failed with status: 401 Unauthorized

Proget version 5.2.25 (Build 14) . Running in docker container on Centos 7
BaseURL = https://proget.company.com
Nginx config

server {
    client_max_body_size 0;
    listen 443 ssl;
    server_name proget.company.com;
    ssl on;
    chunked_transfer_encoding on;
    location / {
        proxy_set_header X-Forwarded-Host $host;
	proxy_set_header X-Forwarded-Server $host;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header Host $host;
	proxy_redirect off;
	proxy_buffering off;
	proxy_request_buffering off;
	proxy_connect_timeout 1m;
	proxy_read_timeout 1h;
	proxy_send_timeout 1h;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection $http_connection;
        proxy_pass http://intenal.proget;
    }
}

araxnid_6067

anyone ?

atripp

Hello; this should get resolved in PG-1676, which is scheduled for the next maintence release.

araxnid_6067

Thank you!

araxnid_6067

@atripp
Unfortunately update didn't help.

docker login proget.company.com
Username: Admin
Password:
Error response from daemon: Get https://proget.company.com/v2/: unauthorized: authentication required

araxnid_6067

Guys ?! It's a real blocker.

atripp

It's really hard to say. This doesn't seem to be impacting others... we can't repro it... and I'm not sure what else it could be.

If you can get us some more very specific details about it, perhaps using some sort of fidler trace, then we can try to investigate further.

viceice

Seeing the same error after disabling anonymous access

mikhael_3947

@ben Thank you so much I spend a lot of times searching for that. Should it be in proget docker installation documentation (in HTTPS Support section) ? Thank again.
My setup docker client > HAProxy > Proget. Also don't forget to add a HTTP frontend that redirects to HTTPS frontend in HAProxy.

rhessinger

Hi @mikhael_3947,

I have updated our Docker documentation to include this information about using a proxy with ProGet. I have also included more information about insecure registries and using self-signed certificates with Docker registries,

Thanks,
Rich