Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-65073

Image Tag Parameter: HTTP status: Unauthorized

    XMLWordPrintable

    Details

    • Similar Issues:

      Description

      Reading tags from our local docker registry does not work. On the build page there is the error message "HTTP status: Unauthorized" despite providing suitable credentials.

      Relevant log:

      März 10, 2021 1:40:09 NACHM. WARNUNG io.jenkins.plugins.luxair.ImageTag getAuthService
      No AuthService available from https://registry:5000/v2/
      März 10, 2021 1:40:09 NACHM. INFORMATION io.jenkins.plugins.luxair.ImageTag getAuthToken
      Basic authentication
      März 10, 2021 1:40:09 NACHM. SCHWERWIEGEND io.jenkins.plugins.luxair.ErrorInterceptor onFail
      null
      März 10, 2021 1:40:09 NACHM. WARNUNG io.jenkins.plugins.luxair.ImageTag getAuthToken
      Token not received
      März 10, 2021 1:40:09 NACHM. WARNUNG io.jenkins.plugins.luxair.ImageTag getImageTagsFromRegistry
      HTTP status: Unauthorized
      

       

      On the registry server there is a corresponding log message: 

      [10/Mar/2021:12:40:09 +0000] "GET /v2/ HTTP/1.1" 401 87 "" "unirest-java/3.1.00"
      time="2021-03-10T12:40:09.103392767Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.2 http.request.host="registry:5000" http.request.id=69f6942d-62b0-4658-bd91-e008b43b8e6c http.request.method=GET http.request.remoteaddr="REMOTE_IP:38834" http.request.uri="/v2/MY_IMAGE/tags/list" http.request.useragent="unirest-java/3.1.00" vars.name="MY_IMAGE" 
      

       

      I used curl to see whats going on: 

      $ curl https://registry:5000/v2/    
      {"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]} 
      

       Using "-v" I can see that the www-authenticate header points correctly to our auth-service (which is running on the same server, but on different port)

      www-authenticate: Bearer realm="https://registry:5001/auth",service="Docker registry"

      Running

      curl --user USERNAME:PASSWORD https://registry:5001/auth

      correctly returns an access_token.

       

        Attachments

          Activity

          Hide
          maduma Stéphane Nsakala added a comment - - edited

          Looking at the code the problem is that there is a 'space' in the service name: service="Docker registry"

           

          www-authenticate: Bearer realm="https://registry:5001/auth",service="Docker registry"

           

          On the code the pattern do not accept space.

          String pattern = "Bearer realm=\"(\\S+)\",service=\"(\\S+)\"";

           https://github.com/jenkinsci/image-tag-parameter-plugin/blob/042be3b1403f5c39b102f485a3871fdc7048c97b/src/main/java/io/jenkins/plugins/luxair/ImageTag.java#L104

          What is the registry vendor ?

          Show
          maduma Stéphane Nsakala added a comment - - edited Looking at the code the problem is that there is a 'space' in the service name: service="Docker registry"   www-authenticate: Bearer realm="https://registry:5001/auth",service="Docker registry"   On the code the pattern do not accept space. String pattern = "Bearer realm=\"(\\S+)\",service=\"(\\S+)\"";   https://github.com/jenkinsci/image-tag-parameter-plugin/blob/042be3b1403f5c39b102f485a3871fdc7048c97b/src/main/java/io/jenkins/plugins/luxair/ImageTag.java#L104 What is the registry vendor ?
          Hide
          maduma Stéphane Nsakala added a comment -

          you can test a fix here

          https://ci.jenkins.io/job/Plugins/job/image-tag-parameter-plugin/view/change-requests/job/PR-49/

          Please provide your result with different registry

          Show
          maduma Stéphane Nsakala added a comment - you can test a fix here https://ci.jenkins.io/job/Plugins/job/image-tag-parameter-plugin/view/change-requests/job/PR-49/ Please provide your result with different registry
          Hide
          gordin Christoph Vogtländer added a comment -

          I'm using the Docker registry from https://hub.docker.com/_/registry

          After changing the Auth/Token-servers name to "Docker_registry" the plug-in (version 1.9) was showing the tags as expected.

          Resetting the name to "Docker registry" and using the plug-in from PR-49 also works as expected.

          Show
          gordin Christoph Vogtländer added a comment - I'm using the Docker registry from https://hub.docker.com/_/registry After changing the Auth/Token-servers name to "Docker_registry" the plug-in (version 1.9) was showing the tags as expected. Resetting the name to "Docker registry" and using the plug-in from PR-49 also works as expected.

            People

            Assignee:
            maduma Stéphane Nsakala
            Reporter:
            gordin Christoph Vogtländer
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: