search

chocolatey / choco

Chocolatey - the package manager for Windows
https://chocolatey.org
Other
10.34k stars 903 forks source link

push - add authentication same as with other methods that use sources #2026

Open kev494 opened 4 years ago

kev494 commented 4 years ago

I would like to restrict the choco sources with some sort of authentication. I have the ability to add user and password or a certificate when adding e chocolatey source on the client. This means for me I can define basic oder certificate-based authentication in the IIS settings. Then, I would disable anonymous access. This works fine and packages from this source can only be installed with username and password (when setup basic auth). However, I'm now not able to choco push to this source anymore. I will get an unauthorized exception. 

> choco push -s https://servername/chocolatey -f --api-key=someapikey
Chocolatey v0.10.15
Attempting to push GoogleChrome.77.0.3865.000.nupkg to https://servername/chocolatey
Failed to process request. 'Unauthorized'.
The remote server returned an error: (401) Unauthorized..

I asked for help on gitter and get some interesting insights that this could be avoided with using nuget.exe. Like it is done here https://blog.pauby.com/post/chocolatey-repository-using-azure-devops-artifacts-feed/. Not sure if it will work for IIS based Webserver as well. But, I will find out.

My questions from all of this is, if it would be possible to add the same authentication methods for choco push as they exist for choco source? So this can be achieved with chocolatey commands.

choco push -s https://servername/chocolatey -f --api-key=someapikey -u user -p pw
choco push -s https://servername/chocolatey -f --api-key=someapikey -cert path-to-cert

If I'm missing something, I'm happy to hear if there are better options. Thanks in Advance for your help.

ferventcoder commented 4 years ago

@kev494 this is a good request! I've updated it a bit for our purposes and have marked it as up for grabs for anyone that might want to take a stab at it.

I'm wondering if it is required to add something on the server side as well once it is turned on on the client side. I know with Chocolatey Server, we specifically had to allow pushes to go through without hitting basic/cert auth as the API should be all that is necessary there as credentials.

Are you using Chocolatey.Server and hitting this or something else?

kev494 commented 4 years ago

@ferventcoder exactly, I was hitting this with Chocolatey.Server and think there will happen for each Server which uses IIS. Did you set it up that installs hit basic/cert auth and pushes not? How did you achieve this?

JPRuskin commented 2 weeks ago

To add a little to this, Sonatype Nexus sources can be pushed to with anonymous authentication turned off, but you have to add a source matching the push-endpoint with your working credentials - and then push using your API key.