Artifactory behind Apache using basic auth and anonymous browsing

2
votes

I'm trying to run Artifactory behind an Apache proxy with basic auth. I've done this for a few other webapps (Jira, Jenkins, AnthillOS), but am having a problem with Artifactory. The Apache config proxies /artifactory to the stand-alone Artifactory server, and defines basic auth for the /artifactory path:

<Location "/artifactory">
  AuthUserFile /prod/data/apachePasswords
  AuthName "My Realm"
  AuthGroupFile /dev/null
  AuthType Basic
  Require valid-user
</Location>

Anonymous browsing is activated in Artifactory.

When I attempt access via a web browser, I first receive the authentication dialog from Apache. After successfully entering those credentials, I'm given another authentication dialog, this one for the "Artifactory Realm". After entering credentials for an Artifactory acccount, I'm re-presented the first authentication dialog and the cycle continues.

I'd like to get just the first dialog, then go directly to Artifactory for anonymous browsing. If I disable the authentication in Apache, I can anonymously browse Artifactory, but when I enable basic auth in Apache, I get two separate circular authentication dialogs. Any ideas how I can kill that second dialog?

2
apachebasic-authenticationartifactory

2 Answers

3
votes

I ran into the same problem this week. The login for the "Artifactory Realm" is the same as the default login for the Artifactory (admin/password). When you login to the "Artifactory Realm" it will log you into the Artifactory gui. I'm using Artifactory 2.6.5

1
votes

I had the same issue and fixed it by unsetting the authorization header in the Apache proxy. It looks like the Artifactory is getting upset by this authorization header (from the first dialog) and requires a "good" Artifactory password in the second dialog. Here is my config:

<Location / >
    AuthType basic
    AuthName "Apache authenticate"
    AuthUserFile /var/www/repo.domain.com/.htpasswd
    AuthGroupFile /dev/null
    Require valid-user

    RequestHeader unset Authorization

    ProxyPass http://repo.company.local:8081/artifactory/repo/
    ProxyPassReverse http://repo.company.local:8081/artifactory/repo/
</Location>

To use the unset header feature mod_headers must be enabled.