[WAGON-590] Maven 3.5.0+ doesn't seem to send credentials after 301/302 HTTP redirect

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Information Provided
• Affects Version/s: 3.4.0
• Assignee: Michael Osipov
• Reporter: Cintia DR
• Created: 27/Apr/20 09:21
• Updated: 25/Apr/21 21:25
• Resolved: 04/Dec/20 17:56

Description

Since maven 3.5.0 (including 3.6.3), maven seems to not send server credentials if distributionManagement server response was a 301 or 302 HTTP redirect. Note that the redirect is followed, but I receive unauthorised code.

Maven 3.2.5 and 3.3.9 work as expected. I could reproduce it on ubuntu and OSX. Both are JDK 8, not sure if it could make any difference.

 

All maven versions (including 3.2.5 and 3.3.9) are using the same version of the deploy plugin (2.7), and upgrading it made no difference whatsoever.

---

If I use 'https://openmrs.jfrog.io/artifactory/snapshots/' as my 'distributionManagement', credentials are sent.

If I use 'https://mavenrepo.openmrs.org/proxy/snapshots/' (a reverse proxy to 'https://openmrs.jfrog.io/artifactory/snapshots/') credentials are sent.

If I use 'https://mavenrepo.openmrs.org/snapshots/' (a 301 redirect to https://openmrs.jfrog.io/artifactory/snapshots/) as my distributionManagement, credentials are not sent and the request fails as it's unauthenticated. 

 

You can see the configuration of 'mavenrepo.openmrs.org' server here: https://github.com/openmrs/openmrs-contrib-itsmresources/blob/master/ansible/host_vars/campo.openmrs.org/vars#L33

 

All my artefacts are public to download, so I don't have a way to testing downloading artefacts with server credentials.

 

---

This is how the output looks like in maven 3.6.3:

 
[INFO] --- maven-deploy-plugin:2.7:deploy (default-deploy) @ releasetestmodule ---
Downloading from openmrs-repo-snapshots: https://mavenrepo.openmrs.org/nexus/content/repositories/snapshots/org/openmrs/module/releasetestmodule/2.1.22-SNAPSHOT/maven-metadata.xml
Downloaded from openmrs-repo-snapshots: https://mavenrepo.openmrs.org/nexus/content/repositories/snapshots/org/openmrs/module/releasetestmodule/2.1.22-SNAPSHOT/maven-metadata.xml (616 B at 132 B/s)
Uploading to openmrs-repo-snapshots: https://mavenrepo.openmrs.org/nexus/content/repositories/snapshots/org/openmrs/module/releasetestmodule/2.1.22-SNAPSHOT/releasetestmodule-2.1.22-20200427.091851-13.pom
...
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.7:deploy (default-deploy) on project releasetestmodule: Failed to deploy artifacts: Could not transfer artifact org.openmrs.module:releasetestmodule:pom:2.1.22-20200427.091851-13 from/to openmrs-repo-snapshots (https://mavenrepo.openmrs.org/nexus/content/repositories/snapshots): Transfer failed for https://openmrs.jfrog.io/artifactory/snapshots/org/openmrs/module/releasetestmodule/2.1.22-SNAPSHOT/releasetestmodule-2.1.22-20200427.091851-13.pom 401 Unauthorized -> [Help 1]

Issue Links

• causes: HTTPCLIENT-2078 Log debug message when no credentials for given auth scope are found
• depends upon: WAGON-591 Transfer event is not restarted when request is redirected
• is related to: WAGON-592 Wagon fails when compiled on Java 9+ and run on Java 8 due to JDK API breakage
• links to: GitHub Pull Request #217