[MRM-1181] HTTP 401 - Unauthorized is Returned when Accessing Artifact from Repository Group if the User Doesn't Have Access to All Repositories in the Group

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.2
• Fix Version/s: 2.0.1
• Component/s: Users/Security
• Labels: TOCHECK
• Environment: Archiva 1.2; Tomcat 6.0.16; JRE 1.6.0_06-b02
• Assignee: Olivier Lamy
• Reporter: Scott Seiter
• Created: 07/May/09 18:40
• Updated: 05/Mar/14 22:50
• Resolved: 05/Mar/14 22:50

Description

When trying to access an artifact via a repository group, Archiva returns 'HTTP 401 - Unauthorized' when the artifact can't be found in the set of repositories the user has access to and there is at least 1 repository in the repository group the user doesn't have permission to access.

In this case it may be more logical to return an HTTP 404 instead of an HTTP 401.

On the client machine, Maven responds to the 401 with (where the repository group name is group-repo-name):

[WARNING] repository metadata for: 'artifact org.apache.maven.plugins:maven-checkstyle-plugin' could not be retrieved from repository: group-repo-name due to an error: Error transferring file
[INFO] Repository 'group-repo-name' will be blacklisted

By the way, the artifact being requested is http://maven.co.myorganization.org/archiva/repository/group-repo-name/org/apache/maven/plugins/maven-checkstyle-plugin/2.2/maven-checkstyle-plugin-2.2.pom.

Another note, the wire trace shows that the client requests the resource 20 times and receives 20 HTTP 401 messages from the server in response.

Issue Links

• relates to: MRM-1348 Migrate repository groups to the new repository API