26

Closed

Prompt for credentials when making a request behind a Proxy that requires basic authentication

description

As it's not uncommon to be in a company's network with the only way to go over the Internet is a Proxy (with Basic Authentication), please
add such a feature.
It'd improve the usage from Devs inside restricted Networks.

Thank you

Discussion: http://nuget.codeplex.com/discussions/227886
Closed May 8, 2012 at 5:55 PM by CodePlexAdmin
Bulk resetting Issues that were moved to Fixed from Closed due to CodePlex bug.

comments

dfowler wrote Oct 13, 2010 at 12:23 AM

This doesn't work for you now?

igoran wrote Oct 13, 2010 at 7:24 AM

Where do I set Proxy Credentials ? They're NOT the same as my Windows Login.

Haacked wrote Oct 13, 2010 at 3:39 PM

Aren't we just reading the WinInet settings? In other words, change those settings in "Internet Options" within the "Control Panel". Report back if that doesn't work. :)

Haacked wrote Oct 13, 2010 at 11:58 PM

Please provide more details.

erichexter wrote Oct 14, 2010 at 2:45 PM

We added some logic to handle NTLM proxies. So, I think there may be some additional logic around detecting when the User Credentials are set on the webclient/webrequest object.

Haacked wrote Oct 19, 2010 at 9:08 PM

Can you provide more details? What exactly did you do? What specific errors did you get? How have you set up your internet option? Thanks.

igoran wrote Oct 20, 2010 at 10:10 AM

I got the following error typing list-package:

PM> list-package
Exception calling "GetPackages" with "0" argument(s): "Unable to read feed. Verify that a feed is hosted at the remote server and
is available."
At C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\Extensions\CodePlex Foundation\NuPack Tools\0.1\Scripts\nupack.ps1:2
57 char:35
  • return $repository.GetPackages <<<< () | Select-Object Id, Version, Description
    • CategoryInfo : NotSpecified: (:) [], ParentContainsErrorRecordException
    • FullyQualifiedErrorId : DotNetMethodException
Naturally, it doesn't work Add-Package either:
PM> Add-Package elmah
_WriteError : Unable to read feed. Verify that a feed is hosted at the remote server and is available.
At C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\Extensions\CodePlex Foundation\NuPack Tools\0.1\Scripts\nupack.ps1:1
07 char:24
  • WriteError <<<< $.Exception
    • CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
    • FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,_WriteError
It seems I'm in the same scenario as the issue with Id #249 (Proxy Authentication Required)

I'm behind a corporate proxy (as unique way to go over the Internet) and it requires Basic Authentication with Credentials unrelated
to my Windows Login.

Hope this can help.

Igor.

Haacked wrote Oct 20, 2010 at 3:57 PM

Related issue: http://nupack.codeplex.com/workitem/249

Haacked wrote Oct 20, 2010 at 4:00 PM

Thanks Igor. If you use IE, does it connect to the internet just fine? If you go to START | RUN | INTERNET OPTIONS do you have your proxy settings configured in there?

igoran wrote Oct 21, 2010 at 8:11 AM

Dear Phil,
As from your request, I can confirm the proxy is set in the Internet Options. The Browser works correctly after asking me Credentials for Proxy Access.

Haacked wrote Oct 21, 2010 at 3:37 PM

Thanks Igoran.

Haacked wrote Oct 25, 2010 at 5:57 PM

Drew, any chance you can try and setup an environment that can repro this? I'll post something to the discussion asking for help.

AnglicanGeek wrote Oct 25, 2010 at 11:06 PM

Yeah, I'll set up a basic auth'd proxy and try to repro. I probably won't have everything in place until tomorrow.

JamesFleming wrote Oct 27, 2010 at 7:19 PM

I have been asked to investigate hosting an internal RSS feed and am having the same problem when I test this locally on one box.
Steps to reproduce are as follows:
  1. I followed Phils tutorial: http://haacked.com/archive/2010/10/21/hosting-your-own-local-and-remote-nupack-feeds.aspx on my dev laptop (Custom Read Only Feeds section)
  2. Hit Ctrl + F5
    3 Open up a new instance of VS2010
  3. Add package source
  4. list-package
    6: Boom goes the dynamite...
PM> list-package
Exception calling "GetPackages" with "0" argument(s): "Unable to read feed. Verify that a feed is hosted at the remote server and is available."
At C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\Extensions\CodePlex Foundation\NuPack Tools\0.1\Scripts\nupack.ps1:257 char:35
  • return $repository.GetPackages <<<< () | Select-Object Id, Version, Description
    • CategoryInfo : NotSpecified: (:) [], ParentContainsErrorRecordException
    • FullyQualifiedErrorId : DotNetMethodException

Haacked wrote Nov 15, 2010 at 9:34 PM

Please follow up with Eric Hexter. I think he had problems before but now it works for him.

Haacked wrote Nov 23, 2010 at 12:17 AM

I've attached a screenshot of the Proxy preferences for Windows Live Writer. I'm guessing we should do something similar and expose it via the Tools Options dialog.

igoran wrote Nov 23, 2010 at 8:11 AM

Thank you Haacked, it'd be the right path to the solution (speaking as end-user)...

Haacked wrote Nov 23, 2010 at 10:21 PM

Taking a look at this.

Haacked wrote Nov 25, 2010 at 4:27 AM

@igoran, @JamesFleming I've attached a private build that allows you to configure the proxy settings. Can you give it a try and let us know if it works?

davidebbo wrote Nov 25, 2010 at 5:46 AM

I haven't looked at the code, but can you explain more generally why this is needed at all? We should in theory be relying on the IE proxy settings, and we know that it is working fine for Eric Hexter. The whole point of those settings is to not have to implement proxy support for every app that needs to make http requests. e.g. what about our NuGet.exe console app? Is it going to need its own proxy support as well? Same seems crazy.

I may very well be missing something obvious here, but I don't see any info about this reading through the bug (http://nuget.codeplex.com/workitem/231). I goes straight from 'this should just work' to 'we should add a dialog', with no info about why it doesn't just work.

davidebbo wrote Nov 25, 2010 at 5:47 AM

Haacked's reply:

I believe it's for proxy servers that require authentication and need credentials that differ from the current user's credentials. Maybe I missed something but I couldn't find a way to specify user name and password when configuring a proxy via the Internet Options dialog.

Per the bug report, I modeled our implementation to the Proxy settings in Windows Live Writer.

I'll ask that team why they needed this to see what reasons they had for implementing a proxy settings dialog.

davidebbo wrote Nov 25, 2010 at 5:53 AM

So I don't know much about those proxies, but how does it work in other scenarios on those same machines. e.g.
  • Accessing the web from IE (for example accessing the feed): do you get prompted for credentials?
  • Other VS features that use http, like the Extension Gallery. Do they have support for this?
  • Our NuGet.exe console app to list and upload packages
I'd really like to understand the fuller picture before jumping to create our own proxy UI that only works for this very specific feature. Though I'm missing some pieces, my initial reaction is that it feels wrong.

Haacked wrote Nov 26, 2010 at 8:24 AM

I have a new private build to try out. We decided to go with the approach where we prompt for credentials. This fits the behavior of most other clients. I've only implemented it for the Add Package Dialog so far. Please give it a try and let me know if it works for you.

igoran wrote Nov 26, 2010 at 10:46 AM

I'll give a try within the next 48h as I'm not in the scenario I can do that.
Thank you very much to all people trying to fix the issue.

Haacked wrote Nov 26, 2010 at 7:27 PM

Whoops, I think I uploaded the wrong one last time.

Haacked wrote Nov 27, 2010 at 4:59 AM

Updated. This one has support for setting proxy credentials via command line, though it's a bit cumbersome.

Haacked wrote Nov 29, 2010 at 6:37 PM

We're going to punt this to v1.1. We want to do this right and not ship an incomplete solution.

jamiebarrow wrote Jan 28, 2011 at 10:30 AM

Thanks Haacked, that build works perfectly for me. NuGet used the stored proxy user and password.

JohnWigger wrote Feb 14, 2011 at 4:10 PM

Now that version 1.1 has been released, am I correct in thinking that this support isn't available yet? Unfortunately, I need to supply proxy credentials at my place of work.

jfollas wrote Apr 1, 2011 at 1:11 PM

The type of corporate proxy server that I am behind operates transparently and implicitly (it might be related to F5 Networks BIG-IP, but I'm not a network guy, so I don't know for sure). That is, I don't need to configure a proxy server.

The way that authentication works with this type of proxy server is that it intercepts unauthenticated requests and uses standard HTTP 401's until it receives an appropriate Authorization header. Then it sets two cookies ("BCSI-ACP..." and "BCSI-AC...") and redirects back to the original URL.

With Fiddler, I can see all of the redirects taking place, but I can also see that the NuGet PM never provides the cookies. Therefore, the post-authentication redirect (that is supposed to have the cookies) results in another interception by the proxy server in order to authenticate and set the cookies again. Lather, rinse, repeat until the PM throws an exception.

In this case, I think just maintaining cookies as part of the web client's request/response handling will solve a lot of modern corporate proxy issues.

jfollas wrote Apr 1, 2011 at 1:26 PM

A little searching, and I discover that BCSI (in the cookie names) means Blue Coat Systems, Inc... So that's the type of proxy being used here that is not compatible with the current NuGet networking code.

Haacked wrote Apr 5, 2011 at 11:29 PM

From the linked discussion

The issue is that the CredentialCache.DefaultCredentials property applies only to NTLM, negotiate, and Kerberos-based authentication. From the MSDN documentation page it specifically states "This method does not work for HTTP or FTP protocols." So if your corporate firewall happens to support supplying proxy credentials using one of those mechanisms, you're good to go. But there are many of us out here who simply have to supply our plain text credentials each time. Personally, I am comfortable with being prompted for my credentials each time I need to download a packge (I'm already prompted every time Visual Studio needs to check for updated versions of Extension Manager plugins as well as when the Start page attempts to download the news feed). My corporate policy forces me to change my password so often that I never check the "Remember My Password" type options when presented with them (it's a sure way to get my account locked out the next time I do change it and the software that remembers it "helpfully" retries more than 3 times with my old password). So may I suggest at the minimum incorporating the logic that has been floating around for some time where in the presence of a non-null Proxy object on the WebClient you test for the existence of non-null NetworkCredentials under that and if not found you prompt the user to enter just the username and password? (You don't need to deal with any other proxy settings as those are all managed through Internet Explorer and respected by the WebClient). If you want to offer a "Remember My Password" option, then you would want to leverage DPAPI through the System.Security.Cryptography.ProtectedData class (a good example of using it is posted on Jon Galloway's blog at http://weblogs.asp.net/jgalloway/archive/2008/04/13/encrypting-passwords-in-a-net-app-config-file.aspx under the section titled Encrypting Strings With ProtectedData).

Hope this helps and please do consider implementing this...otherwise many of us have to wait until we go home every day to be able to download a new package...

Cheers,

-Brian

dfowler wrote May 16, 2011 at 1:58 AM

Fixed in changeset e372a83ec6cd

dfowler wrote May 19, 2011 at 7:18 AM

Fixed in CS 6c579d345467 - 68729c315e7b

dfowler wrote May 19, 2011 at 7:19 AM

This bug represents changes added to core, the console and bootstrapper. I'm going to open another bug for the VS work.

AlistairB wrote Jun 6, 2011 at 1:37 AM

Same issue here.

"The package source named 'NuGet official package source [https://go.microsoft.com/fwlink/?LinkID=206669' is either invalid or not available and thus is currently unreachable".

Everything else works through the proxy. This includes the Latest News in VS which will prompt for credentials.

Note: at my work we are using an auto configuration .pac file.

AlistairB wrote Jun 19, 2011 at 10:26 PM

Not fixed for me in 1.4.

PM> Get-Package -ListAvailable
Get-Package : Unable to connect to the remote server
At line:1 char:12
  • Get-Package <<<< -ListAvailable
    • CategoryInfo : NotSpecified: (:) [Get-Package], WebException
    • FullyQualifiedErrorId : NuGetCmdletUnhandledException,NuGet.PowerShell.Commands.GetPackageCommand

thomasswilliams wrote Jun 21, 2011 at 10:56 PM

Not fixed for me in 1.4.20615.9020:
PM> Get-Package -ListAvailable
Get-Package : Unable to connect to the remote server
At line:1 char:12
  • Get-Package <<<< -ListAvailable
    • CategoryInfo : NotSpecified: (:) [Get-Package], WebException
    • FullyQualifiedErrorId : NuGetCmdletUnhandledException,NuGet.PowerShell.Commands.GetPackageCommand

dfowler wrote Jun 22, 2011 at 11:39 AM

This doesn't work in the VS extension as yet. That's in 1.5

scottmeyer wrote Jun 22, 2011 at 3:19 PM

I just wanted to say that explicitly specifying my proxy address as in this SO post: http://stackoverflow.com/questions/2859148/visual-studio-2010-cannot-connect-for-any-online-resource allowed my to browse the packages through the VS package manager.

thomasswilliams wrote Jun 23, 2011 at 5:44 AM

Thanks for the tip Scott - no combination of the solutions on http://stackoverflow.com/questions/2859148/visual-studio-2010-cannot-connect-for-any-online-resource worked for me. Same error "Unable to connect to the remote server". No proxy login box popped up (BTW, features like the VS Start Page - not that I use it - don't work either)

Appreciate the help. I'm willing to concede this isn't a NuGet problem but a VS/proxy problem.

scottmeyer wrote Jun 30, 2011 at 4:53 PM

Thomas, this is what I ended up with finally in my devenv.exe.config file (It's a combination of a few soultions):

<system.net>
    <defaultProxy useDefaultCredentials="true" enabled="true">
        <proxy proxyaddress="http://proxyaddress" />
    </defaultProxy>
    <settings>
    <servicePointManager expect100Continue="false" />
        <ipv6 enabled="true"/>
    </settings>
</system.net>

dfowler wrote Aug 12, 2011 at 8:27 AM

Can everyone try this build out http://nuget.codeplex.com/discussions/268781

pranavkm wrote May 4, 2012 at 12:28 AM

Fixed in changeset d957117326eb

Sign in to add a comment