Powershell private repo fails with 401

chris_5235

Hi

I have a dummy module in proget, configured as a private repository. A user is created with permission to read and download packages, called feedconsumer. My Proget instance is a docker container, behind an nginx container.

Find-Module queries succesfully locate the module with the credentials.

My attempts to install the module fail, and the sequence of requests seems to suggest PS decides to ditch the creds part way through.

proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/ HTTP/1.1" 200 273 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/FindPackagesById()?id='FoooBarr' HTTP/1.1" 200 484 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/ HTTP/1.1" 200 273 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/FindPackagesById()?id='FoooBarr' HTTP/1.1" 200 484 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/FindPackagesById()?id='Test-FooBar'&$skip=0&$top=40 HTTP/1.1" 200 1484 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/ HTTP/1.1" 200 273 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/FindPackagesById()?id='FoooBarr' HTTP/1.1" 200 484 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/ HTTP/1.1" 200 273 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/FindPackagesById()?id='FoooBarr' HTTP/1.1" 200 484 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - feedconsumer [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/FindPackagesById()?id='Test-FooBar'&$skip=0&$top=40 HTTP/1.1" 200 1484 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"
proget.domain.tld 186.93.151.237 - - [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/package/Test-FooBar/1.0.2 HTTP/1.1" 301 169 "-" "Mozilla/5.0 NuGet" "-"
proget.domain.tld 186.93.151.237 - - [02/May/2022:06:34:47 +0000] "GET /nuget/rmm-psget/package/Test-FooBar/1.0.2 HTTP/1.1" 401 115 "-" "Mozilla/5.0 NuGet" "172.19.0.3:80"

All of the PS queries utilise the feedconsumer credential. However, the last two entries in the output suggest the actual module download is attempted without a credential passed. This obviously results in a 401.

Additionally, a simple IWR with creds at the 401 endpoint successfully downloads the package.

iwr https://proget.domain.tld/nuget/rmm-psget/package/Test-FooBar/1.0.2 -Credential $Pullcreds

Could anyone point me in the right direction to troubleshoot this further?

Dan_Woolf

Hi @chris_5235,

Can you please tell us what version of ProGet you are running? Also just to make sure I understand this correctly, you have a private PowerShell repository and this error is happening when you call Install-Module in PowerShell?

Would you be able to to share how you configured PowerShell to use ProGet as your repository as well as an example of how you are calling Install-Module?

Thanks,
Dan

chris_5235

@chris_5235 said in Powershell private repo fails with 401:

Hey Dan

Cheers for the reply. Yep the error is on the call to Install-Module.

According to the web UI, our proget instance is running version 6.0.13 (Build 1).

Here's the basic sequence used to add the repo and attempt the installation...

$RepoName   = 'rmm-psget'
$RepoUri    = 'https://proget.domain.tld/nuget/rmm-psget/'
$PullUser   = 'feedconsumer'
$PullPass   = 'secret'
$ModuleName = 'Test-FooBar'
$PullCreds  = New-Object PsCredential ($PullUser,(ConvertTo-SecureString $PullPass -AsPlainText -Force))
Register-PSRepository -Name $RepoName -SourceLocation $RepoUri -PublishLocation $RepoUri -InstallationPolicy Trusted -Credential $PullCreds
Install-Module -Name $ModuleName -Repository $RepoName -Credential $PullCreds

The actual error on the client side is

PackageManagement\Install-Package : Package 'Test-FooBar' failed to be installed because: End of Central Directory record could not be found.

The log entry I encluded in the OP is triggered during the Install-Module call. The search successfully finds the package but the installation process itself fails, throwing a 301 and subsequent 401 from the server side.

atripp

Hi @chris_5235,

Unfortunately I'm not really sure what's happening, but I suspect it has to do with an HTTPS redirect?? I would look there next.

As you mentioned in the OP, the package can be download from the endpoint, so long as you provide the credentials. So, I guess, PowerShell isn't sending credentials after a redirect, perhaps?

One thing that you might want to do, is use a tool like Fiddler to capture the request/responses. That will let you verify that the issue is indeed PowerShell not passing credentials to ProGet. You can look at the authentication header.

Things to look at:

make sure ProGet is sending an https download link for the package file in the FindPackagesById() request
X-Forwarded-Proto is set to be https
If you must, set BaseUrl under advanced settings

Cheers,
Alana

chris_5235

@atripp
Thanks for the pointers. Investigations did indeed reveal that proget was replying with the http url if FindPackagesById() request and that the subsequent redirect back to https was causing the credential to be dropped from the request.

I've configured the BaseUrl with advanced settings and confirmed success with that in place.

I now have a functioning proget instance and I'm able to efficiently work with the repo from Powershell. Much appreciated!