Where has NuGet API Key gone from Manage Feed page?

[Neil Williams]

Hi,

In version 4.8.6 on the Manage Feed page (Administration > Feeds > MyNugetFeed) there is a field called NuGet API Key.

When this was set and anonymous access was given to Feeds_AddPackage (as described in https://inedo.com/support/kb/1112/api-keys-in-proget) then I was required to pass the API key when pushing to that ProGet feed, using NuGet.exe. Excellent.

In the latest version of ProGet, this field has disappeared (or at least I can't find it). Not so excellent.

Can you tell me where it is, or how I might be able to do what was possible in v4.8.6?

Thanks,
Neil

Product: ProGet
Version: 5.0.8

[Bryan]

That KB seems to be quite outdated...

Now you can just create an API Key in Admin > API Keys with Feed Access

[Neil Williams]

Hi Bryan,

Thanks for your response.

However, it hasn't helped me.

On my Administration Overview page (http://????/Administration) under Security & Authentication I see an API Key & Access Logs link. Is this what you mean?

I don't believe this will give me what the previous version used to offer (which allowed me to specify a key on each feed from the manage feed page), because there is no field in which to enter the feed I wish to protect.

Imagine I have three feeds. I wish to protect two of them with separate API Keys, and the third I don't wish to protect at all.

How do I do it now? Please provide as much detail as you can.

Thank you,

Neil

[Bryan]

Yes, I first created a user (FeedUserA, FeedUserB, etc), and gave that user permission to the feeds (like , sometimes you want to be able to push only, or overwrite packages in other cases).

Then, create an API key, and associate it with that user.

[Neil Williams]

Hi Bryan,
Thanks again for your response. I think I haven't been clear in what I am attempting to do.
In the previous version of ProGet:

1. I would assign an API key (myFeedKey) to my feed (http://proget.mydomain/nuget/myFeed) on the Feed Maintenance screen.
2. In the Adminstration/Security/Tasks page I would add Anonymous as a user to the Publish Packages task.
3. Finally, then, any user can make the following call to upload a package successfully:

nuget push MyPackage.0.1.0.nupkg -Source http://proget.mydomain/nuget/myFeed -ApiKey myFeedKey

4. I make a call omitting the ApiKey and it fails (as expected).

So in the new version of ProGet,

1. I can't set the APIKey on the feed directly, so I go to the APIKeys and Access Logs screen.
2. I create a key and tick Feed API and set Feed API user to Anonymous.
3. I make the following call to push my package (which is successful)

nuget push MyPackage.0.1.0.nupkg -Source http://proget.mydomain/nuget/myFeed -ApiKey myFeedKey

4. I make a call omitting the ApiKey, and unfortunately, that too is successful.

Is this a bug in ProGet or am I doing something incorrectly?

Regards,
Neil

[apxltd]

The behavior your describing is to be expected; basically the API acts as an impersonation token, meaning... if you supply an apikey, and its associated with a user, then it's as if you logged in as that user.

So in this case, try this:

1. create a user called ApiUser, and give ApiUser access to myFeed as desired
2. go to the APIKeys and Access Logs screen.
3. create a key and tick Feed API and set Feed API user to ApiUser

Assuming myFeed doesn't allow anonymous access (you will need to restrict this from permissions page), then you will need to provide an api key or username/password to access that feed.

In this case, just use the key you created.

Hope that helps!