[MRM-1114] Archiva misleadingly logs an authorization error when deploying during the initial challenge stage

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 1.2-M1
• Component/s: Users/Security, WebDAV Interface
• Assignee: Unassigned
• Reporter: Brett Porter
• Created: 09/Mar/09 02:04
• Updated: 12/Sep/11 11:53
• Resolved: 12/Sep/11 11:53

Description

In ArchivaServletAuthenticator:

log.info( "Authorization Denied [ip=" + request.getRemoteAddr() + ",isWriteRequest=" + isWriteRequest +
  ",permission=" + permission + ",repo=" + repositoryId + "] : " +
  authzResult.getException().getMessage() );

However, when deploying the client will send a request with no credentials first before receiving the challenge, and this is logged in the middle, which causes some confusion.

It should be removed altogether and possibly logged (maybe in a different audit location), but at a later stage where it is finally rejected.

Issue Links

• duplicates: MRM-897 confusing handling of browser-based webdav access for security
• is duplicated by: MRM-1244 Improve Authorization Denied log message