org.apache.ivy.plugins.repository.url.UrlResource#openStream uses java.net.URL#openStream rather than going through the URLHandlerRegistry like init does. This breaks authentication support. I encountered this bug when using a version range specification (1.+) against a secured Maven repository, but I imagine that it can cause any number of other problems. The fix is simply to change openStream to work the same way init does, by replacing
This change passes all tests and solves my problem.