Problem authentication (404) with NPM Feed

[Marijn Stevens]

We had a working feed when using anonymous access, however we unable to make it authenticated. Proget (in the 'configuring npm' info) gives us these instructions:

1. npm config set registry http://proget.crosspoint.nl/npm/accesspoint
2. npm config set always-auth true
3. npm adduser

but the output is a 404:

root@e6957740c653:/home# npm adduser --verbose
npm info it worked if it ends with ok
npm verb cli [ 'node', '/usr/bin/npm', 'adduser', '--verbose' ]
npm info using npm@2.14.2
npm info using node@v0.12.7
npm verb node symlink /usr/bin/node
Username: npm
Password:
Email: (this IS public) npm@crosspoint.nl
npm verb adduser before first PUT { _id: 'org.couchdb.user:npm',
npm verb adduser   name: 'npm',
npm verb adduser   password: 'XXXXX',
npm verb adduser   email: 'npm@crosspoint.nl',
npm verb adduser   type: 'user',
npm verb adduser   roles: [],
npm verb adduser   date: '2015-09-08T11:47:07.637Z' }
npm verb request uri http://proget.crosspoint.nl/npm/accesspoint/-/user/org.couchdb.user:npm
npm verb request new user, so can't send auth
npm info attempt registry request try #1 at 11:47:07
npm verb request id 24dce33e8ec5eb05
npm http request PUT http://proget.crosspoint.nl/npm/accesspoint/-/user/org.couchdb.user:npm
npm http 404 http://proget.crosspoint.nl/npm/accesspoint/-/user/org.couchdb.user:npm

(BTW: The user does exist and is created with the web interface so explained on this page: http://inedo.com/support/kb/1087/introducing-npm-support-for-proget

After searching on this page, I've allready seen this:

/-/user/org.couchdb.user[...]

or

/npm/[FEED]/-/user/org.couchdb.user[...]

and we get an response on the first one url, NOT the second. And thats the one npm is going right now.

The response on the first is: {
error: "MethodNotAllowed",
reason: "Only PUT is currently supported at this URL."
}, but it is expecting something on that address

Versions:
npm -v: 2.14.2
node -v: 0.12.7
proget: Version 3.8.0 (Build 20

Proget isn't behind some proxy and when using Fidder we don't see authentication headers send at all. What might be going wrong here ?

Product: ProGet
Version: 3.8.0

[Marijn Stevens]

Well, when using registry: http://proget.crosspoint.nl, I get:

npm info it worked if it ends with ok npm info using npm@2.14.2 npm info using node@v0.12.7 Username: (npm) npm Password: (or leave unchanged) Email: (this IS public) (npm@crosspoint.nl) npm npm WARN Email must be an email address Email: (this IS public) (npm@crosspoint.nl) npm info attempt registry request try #1 at 07:42:50 npm http request PUT http://proget.crosspoint.nl/-/user/org.couchdb.user:npm npm http 201 http://proget.crosspoint.nl/-/user/org.couchdb.user:npm npm info adduser Authorized user npm npm info ok

In other words, proget does not seem to listen on both
/-/user/org.couchdb.user[...] and /npm/[FEED]/-/user/org.couchdb.user[...] and because the registry is now the baseurl, it can't find the packages.

[Dean]

Strange. It is definitely hitting the same HTTP handler in our code for both URLs. The "Only PUT is currently supported at this URL." message is only displayed for those two URLs, and we only display that message if the HTTP method is not PUT.

Did you notice if, in Fiddler, npm is first making a GET request to that URL?

[Marijn Stevens]

No, haven't noticed it.

Omitting the feed, I at least 'think' its authorized.
# npm -d adduser --registry http://proget.crosspoint.nl/ npm info using npm@2.14.2 npm info using node@v0.12.7 Username: npm Password: Email: (this IS public) npm@crosspoint.nl npm info attempt registry request try #1 at 13:58:34 npm http request PUT http://proget.crosspoint.nl/-/user/org.couchdb.user:npm npm http 201 http://proget.crosspoint.nl/-/user/org.couchdb.user:npm npm info adduser Authorized user npm npm info ok

However, it fails to find all packages and searches for http://proget.crosspoint.nl/{packagename}.
So attempt two, switching it; I get this:

 # npm -d adduser --registry http://proget.crosspoint.nl/npm/accesspoint

npm info it worked if it ends with ok
npm info using npm@2.14.2
npm info using node@v0.12.7
Username: npm
Password:
Email: (this IS public) npm@crosspoint.nl
npm info attempt registry request try #1 at 14:01:09
npm http request PUT http://proget.crosspoint.nl/npm/accesspoint/-/user/org.couchdb.user:npm
npm http 404 http://proget.crosspoint.nl/npm/accesspoint/-/user/org.couchdb.user:npm
npm ERR! registry error parsing json
npm ERR! Linux 3.16.0-30-generic
npm ERR! argv "node" "/usr/bin/npm" "-d" "adduser" "--registry" "http://proget.crosspoint.nl/npm/accesspoint"
npm ERR! node v0.12.7
npm ERR! npm  v2.14.2

npm ERR! Unexpected token <
npm ERR! <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
npm ERR! <html xmlns="http://www.w3.org/1999/xhtml">
npm ERR! <head>
npm ERR! <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
npm ERR! <title>404 - File or directory not found.</title>
npm ERR! <style type="text/css">
npm ERR! 

So it never authenticates, so I don't know what url it attempts to search for packages.

[Dean]

Ah, I see. We have been able to reproduce this - it looks like a regression in handling the feed-specific npm adduser URL. We've also always handled the /siteroot/-/... one as well because npm used to always use that regardless of the repository URL. I think that changed some time around npm 2.7 when we added the second handler.

Regardless, we've already fixed this internally (again), and will be releasing the fix as part of ProGet 3.8.1 likely some time tomorrow.

Thanks for the help!