• • • Issue 3351 has been marked as a duplicate of this issue. ***

• • • Issue 3352 has been marked as a duplicate of this issue. ***

Hi All,

Any progress on this issue? I run into this issue even I running a 1.6.0_16
version of Java.

The Hudson "ProxyConfiguration" class does mention NTLM, but perhaps it supports
only v1 and not v2 (just guessing).. the only way I've worked with v2 before is
using jcifs and apache httpclient4, as mentioned above.

You can see the code in Hudson here:
https://hudson.dev.java.net/source/browse/hudson/trunk/hudson/main/core/src/main/java/hudson/ProxyConfiguration.java?view=markup
(scroll down to the open(URL url) method)

If you can suggest any changes here to work better with NTLM, let us know.

We have a similar setup except that we run Hudson as a Windows service running as a domain user. This seems to work. If you run Windows service as a system account and specify the username and password then it does not work.

Don't know if this helps or not...

Also see similar issue JENKINS-1833

I have a little more knowledge now how all the proxy stuff works in Java:

Hudson uses the proxy authentication of the Java JVM. The latter implements the NTLM authentication scheme. However it uses the Windows credentials of the process. So by default it uses the login profile if you don't specify one. This means what ever you provide as login and password for the proxy authentication, when your are on Windows and NTLM authentication is required, the JVM will provide the credentials of the process and ignore what you provide.

Artifactory relies on a third party library (HTTPClient) for all its HTTP connection related stuff. This means the JVM authentication is bypassed and the third party proxy authentication is used. HTTPClient has a NTLM v1 implementation and partial but anyway working NTLM v2 implementation. In this case the credentials you provide will be used and not those of the JVM.

Which one is the best to use. Well it depends on the context. HTTPClient might be more flexible (in my case for example) because I cannot run a process under an identity that has proxy access. Moreover you can run your process on a non Windows host. However your NTLM v2 proxy is fully supported by the JVM and may not work with HTTPClient. Then you must deploy on Windows...

Yes, I look to have the same issue, we are running Jenkins as a windows service on a virtualised Win2008 server and get the following when we try to do any updates - even after supplying the proxy details in the advanced tab (we have configured proxy exactly as it is setup in IE internet options, and the username provided is the same domain user that the service runs under - this user has proxy access, surfing the web from the server works when logged in as this user):

Checking internet connectivity
Checking update center connectivity
java.io.IOException: Authentication failure at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source) at hudson.model.UpdateCenter$UpdateCenterConfiguration.testConnection(UpdateCenter.java:737) at hudson.model.UpdateCenter$UpdateCenterConfiguration.checkUpdateCenter(UpdateCenter.java:586) at hudson.model.UpdateCenter$ConnectionCheckJob.run(UpdateCenter.java:884) at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang.Thread.run(Unknown Source)

I see this issue on StackOverflow saying to supply parms to the JRE directly when starting Jenkins, but am unsure as to how we could do this with the windows service setup - in any case from the comment above, it sounds as if it should work when the service user has proxy access:

http://stackoverflow.com/questions/1975564/how-can-i-get-hudson-to-update-through-proxy

Updating the title. The problem is in the NTLM authentication. Basic auth works fine.

I just follow suggestion in https://issues.jenkins-ci.org/browse/JENKINS-32293 by modify start command as below but I still got the error.

my start command
java jar jenkins.war -Djava.net.useSystemProxies=true --httpPort=9999 --logfile=logs/winstone_`date +"%Y%m-%d_%H-%M"`.log &

This is an error.

Feb 17, 2016 4:57:47 PM INFO org.apache.commons.httpclient.HttpMethodDirector processProxyAuthChallenge

Failure authenticating with NTLM <any realm>@172.31.250.200:8080

Feb 17, 2016 4:58:08 PM INFO org.apache.commons.httpclient.auth.AuthChallengeProcessor selectAuthScheme

ntlm authentication scheme selected

Feb 17, 2016 4:58:08 PM SEVERE org.apache.commons.httpclient.HttpMethodDirector authenticate

Credentials cannot be used for NTLM authentication: org.apache.commons.httpclient.UsernamePasswordCredentials
org.apache.commons.httpclient.auth.InvalidCredentialsException: Credentials cannot be used for NTLM authentication: org.apache.commons.httpclient.UsernamePasswordCredentials