http-headers - JFrog Artifactory 使用 403 forbidden 间歇性拒绝身份验证

Question

我很难配置zypper客户(SLES 和 OpenSUSE)与我们的合作 RPM Repository在 JFrog由于一些“身份验证”问题。一开始我以为只是zypper的问题和 opensuse 所以我首先专注于我们努力使事情与 zypper 一起工作。 This是上一个问题。
但是这些与身份验证相关的错误时不时会出现在 yum 中。客户端(centOS)也是如此，虽然不是那么频繁。
所以我试着做 man-in-the-middle看看幕后发生了什么，这是 zypper 的序列:

场景 1 - 成功认证
以下是zypper refresh --repo myrepo的序列:
(1) zypper发送 HTTP HEAD与 base64 的请求-编码 username: :

HEAD /myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml HTTP/1.1
Host: rpm.example.com
Authorization: Basic dXNlcm5hbWU6
User-Agent: ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
Accept: */*
Connection: close

(2) jfrog响应 HTTP 401 Unauthorized与 WWW-Authenticate标题:

HTTP/1.1 401 Unauthorized
Date: Thu, 28 May 2020 08:20:04 GMT
Content-Type: application/json;charset=ISO-8859-1
Connection: close
Server: Artifactory/7.4.3 70403900
X-Artifactory-Id: 2148103ba10eacbb:-16f1c4c1:172093a231a:-8000
X-Artifactory-Node-Id: artifactory-server
WWW-Authenticate: Basic realm="Artifactory Realm"

(3) zypper发送另一个 HTTP HEAD请求，这次是 base64 -编码 username:password :

HEAD /myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml HTTP/1.1
Host: rpm.example.com
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
User-Agent: ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
Accept: */*
Connection: close

(4) jfrog最终以 HTTP 200 响应.

HTTP/1.1 200 OK
Date: Thu, 28 May 2020 08:20:04 GMT
Content-Type: application/xml
Content-Length: 1394
Connection: close
Server: Artifactory/7.4.3 70403900
X-Artifactory-Id: 2148103ba10eacbb:-16f1c4c1:172093a231a:-8000
X-Artifactory-Node-Id: artifactory-server
Last-Modified: Fri, 08 May 2020 10:25:19 GMT
Accept-Ranges: bytes
X-Artifactory-Filename: repomd.xml
Cache-Control: no-store

这些由 Artifactory 记录: artifactory-request.log :

2020-05-28T08:20:34.566Z [5f78297c2aeabaa8] [DENIED LOGIN]   for client : username / 213.1.1.1. 
2020-05-28T08:20:34.870Z [570978212a5318e3] [ACCEPTED DOWNLOAD] myapp-release-rpm-cache:stable/myapp/2019/3/repodata/repomd.xml  for client : username / 213.1.1.1.

artifactory-access.log :

2020-05-28T08:20:34.566Z|5f78297c2aeabaa8|213.2.2.2|non_authenticated_user|HEAD|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|401|-1|0|8|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
2020-05-28T08:20:34.721Z|8018b7cbc9c424e8|213.2.2.2|username|HEAD|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|200|-1|1394|3|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
2020-05-28T08:20:34.870Z|570978212a5318e3|213.2.2.2|username|GET|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|200|-1|1394|2|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
...

所以基本上， zypper带有 HEAD请求，JFrog 说“您未通过身份验证”， zypper响应并尝试进行身份验证，最后 JFrog 对 zypper 进行身份验证。到目前为止是有道理的。

场景 2 - 403 禁止
做一些工作，然后运行相同的 zypper refresh --repo myrepo几分钟后发出命令，结果如下:
(1) zypper发送 HTTP HEAD与 base64 的请求-编码 username: :

HEAD /myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml HTTP/1.1
Host: rpm.example.com
Authorization: Basic dXNlcm5hbWU6
User-Agent: ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
Accept: */*
Connection: close

(2) jfrog响应 HTTP 401 Unauthorized与 WWW-Authenticate标题:

HTTP/1.1 401 Unauthorized
Date: Thu, 28 May 2020 08:30:44 GMT
Content-Type: application/json;charset=ISO-8859-1
Connection: close
Server: Artifactory/7.4.3 70403900
X-Artifactory-Id: 2148103ba10eacbb:-16f1c4c1:172093a231a:-8000
X-Artifactory-Node-Id: artifactory-server
WWW-Authenticate: Basic realm="Artifactory Realm"

(3) zypper发送另一个 HTTP HEAD请求，这次是 base64 -编码 username:password :

HEAD /myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml HTTP/1.1
Host: rpm.example.com
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
User-Agent: ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
Accept: */*
Connection: close

(4) 这一次， jfrog回复 403 Forbidden而不是 200 OK .

HTTP/1.1 403 Forbidden
Date: Thu, 28 May 2020 08:30:44 GMT
Content-Type: application/json;charset=ISO-8859-1
Connection: close
Server: Artifactory/7.4.3 70403900
X-Artifactory-Id: 2148103ba10eacbb:-16f1c4c1:172093a231a:-8000
X-Artifactory-Node-Id: artifactory-server
WWW-Authenticate: Basic realm="Artifactory Realm"

artifactory-request.log :

2020-05-28T08:30:44.496Z [46c81a2450623166] [DENIED LOGIN]   for client : username / 213.1.1.1.
2020-05-28T08:30:44.630Z [769ed41c652daa7a] [DENIED LOGIN]   for client : username / 213.1.1.1.

artifactory-access.log :

2020-05-28T08:30:44.496Z|46c81a2450623166|213.2.2.2|non_authenticated_user|HEAD|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|401|-1|0|9|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64
2020-05-28T08:30:44.630Z|769ed41c652daa7a|213.2.2.2|non_authenticated_user|HEAD|/myapp-release-rpm/stable/myapp/2019/3/repodata/repomd.xml|403|-1|0|1|ZYpp 17.19.0 (curl 7.60.0) openSUSE-Leap-15.1-x86_64

请注意，zypper 发送相同的 Authorization要求进行身份验证时的 header 值，但在第二种情况下， JFrog无法验证请求。
以前有人对 JFrog 有同样的问题吗？我们猜测这是 JFrog 7 的问题，因为我们的最近刚刚升级，但我们无法验证这一点。对我们来说不幸的是，我们采用的是付费计划，它甚至没有支持许可证。
任何建议和意见将不胜感激。
附加信息
可能值得注意的是 yum客户端(centos 和 rhel)在 JFrog Artifactory 上没有这个确切的问题。 ，这很可能是因为 yum 总是在 HTTP header 中发送用户名和密码哈希，避免了 401 Unauthorized重认证序列。
更多细节
我提交了 bug report去年五月到JFrog，至今没有得到任何更新。

Answer 1

您是否尝试将 baseurl 设置为:

http://username:apikey@some.url/artifactory

?