Artifactory auth working when configured but not working in galaxy request

[onefourfive]

Big fan of this project, very excited to get it up and running.

I stood up a POC container pointing to my Artifactory instance, but I'm experiencing a difference between configuring the API key or access token in Galactory vs in a Galaxy request. What did I get wrong?

Info

Version: 0.11.2
Platform: docker

What works

Configuring artifactory-api-key in galactory.conf

galactory.conf

artifactory-api-key=MyArtifactoryToken...
artifactory-path=https://artifactory....
api-version=v3
upload-format=base64

ansible-galaxy collection publish my_demo-collection_demo-1.0.0.tar.gz --token MyArtifactoryToken
Publishing collection artifact '/home/me/git/collection_demo/my_demo-collection_demo-1.0.0.tar.gz' to http://galactory.demo.org:8088/api
Collection has been published to the Galaxy server http://galactory.demo.org:8088/api
Waiting until Galaxy import task http://galactory.demo.org:8088/api/v3/imports/collections/0/ has completed
Collection has been successfully published and imported to the Galaxy server http://galactory.demo.org:8088/api

Collection successfully placed in Artifactory.

What doesn't work

Using Artifactory key in Galaxy request - 401 result

galactory.conf

- artifactory-api-key=MyArtifactoryToken...
+ use-galaxy-auth=True
+ galaxy-auth-type=api_token
artifactory-path=https://artifactory....
api-version=v3
upload-format=base64

ansible-galaxy collection publish my_demo-collection_demo-1.0.0.tar.gz --token MyArtifactoryToken
Publishing collection artifact '/home/me/git/collection_demo/my_demo-collection_demo-1.0.0.tar.gz' to http://galactory.demo.org:8088/api
ERROR! Error when publishing collection to (http://galactory.demo.org:8088/api) (HTTP Code: 401, Message: UNAUTHORIZED Code: Unknown)

No change to Artifactory.

Debug output

With log-headers=True:

galactory-1  | DEBUG:galactory:Headers: Accept-Encoding: identity
galactory-1  | Host: galactory.demo.org:8088
galactory-1  | User-Agent: ansible-galaxy/2.16.3 (Linux; python:3.12.3)
galactory-1  | Connection: close
galactory-1  |
galactory-1  |
galactory-1  | DEBUG:galactory:Body: b''
galactory-1  | INFO:werkzeug:10.126.12.65 - - [24/May/2024 00:58:29] "GET / HTTP/1.1" 200 -
galactory-1  | DEBUG:galactory:Headers: Accept-Encoding: identity
galactory-1  | Host: galactory.demo.org:8088
galactory-1  | User-Agent: ansible-galaxy/2.16.3 (Linux; python:3.12.3)
galactory-1  | Connection: close
galactory-1  |
galactory-1  |
galactory-1  | DEBUG:galactory:Body: b''
galactory-1  | INFO:werkzeug:10.126.12.65 - - [24/May/2024 00:58:29] "GET /api HTTP/1.1" 200 -
galactory-1  | DEBUG:galactory:Headers: Accept-Encoding: identity
galactory-1  | Host: galactory.demo.org:8088
galactory-1  | User-Agent: ansible-galaxy/2.16.3 (Linux; python:3.12.3)
galactory-1  | Content-Type: multipart/form-data; boundary="===============7353633329176979880=="
galactory-1  | Content-Length: 44480
galactory-1  | Connection: close
...
galactory-1  | DEBUG:artifactory:Raw URL passed for encoding: https://artifactory.demo.com/artifactory/galactory-generic-local/my_demo-collection_demo-1.0.0.tar.gz
galactory-1  | DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): artifactory.demo.com:443
galactory-1  | DEBUG:urllib3.connectionpool:https://artifactory.demo.com:443 "PUT /artifactory/galactory-generic-local/my_demo-collection_demo-1.0.0.tar.gz;collection_info=...;fqcn=my_demo.collection_demo;name=collection_demo;namespace=my_demo;version=1.0.0 HTTP/1.1" 401 None
galactory-1  | DEBUG:galactory:401 Client Error:  for url: https://artifactory.demo.com/artifactory/galactory-generic-local/my_demo-collection_demo-1.0.0.tar.gz;collection_info=...;fqcn=my_demo.collection_demo;name=collection_demo;namespace=my_demo;version=1.0.0
galactory-1  | INFO:werkzeug:10.126.12.65 - - [24/May/2024 00:58:29] "POST /api/v3/artifacts/collections/ HTTP/1.1" 401 -

[briantist]

Big fan of this project, very excited to get it up and running.

Thanks very much! Glad to hear it. I'd love to know how you heard about it as well.

---

I can't do any deep debugging right now but I'll try to take a closer look as soon as I can.

I appreciate the detailed report! Could I confirm a few details?

galaxy-auth-type=api_token

This value should be either api_key or access_token, I'm assuming this was a copy/paste or other error in the report and not in your real configuration, because I think this would have failed startup?

Also it seems like you're intending to use an API token and not an access key generally, is that correct?

Is there anything else in the galactory debug output that shows info about the auth process?

It might also be helpful to run ansible-galaxy with -vvvvv and with the environment variable ANSIBLE_DEBUG=true so we can take a look at the request process from the client side and maybe correlate it to something.

[onefourfive]

Thanks for the tip with the library-- I started to get cracking on it and I ran into an issue it seems you yourself have reported! This might be a bit circular but were you able to work around this? devopshq/artifactory#430

[briantist]

ah, there is no way to work around that until someone does the mentioned refactor in that library. You'll need to use a supported Python version. Here are the ones I test Artifactory against (trying to add 3.12 is how I caught the above issue):

• https://github.com/briantist/galactory/blob/main/.github/workflows/test.yml#L20-L23

[onefourfive]

Ok, I've taken some more time to debug this and I think I'm at a interesting point: there is no 'Authorization' header being sent by the ansible-galaxy cli. This is in fact, the complete uncensored header:

galactory-1  | DEBUG:galactory:Headers: Accept-Encoding: identity
galactory-1  | Host: galactory.demo.org:8088
galactory-1  | User-Agent: ansible-galaxy/2.16.3 (Linux; python:3.12.3)
galactory-1  | Content-Type: multipart/form-data; boundary="===============7353633329176979880=="
galactory-1  | Content-Length: 44480
galactory-1  | Connection: close

I inserted some extra lines into the authorize() function in utilities.py to print the Authorization header which came out as None (but the log-headers option was already showing me this!)

The next step for me will be to understand what ansible-galaxy is doing with headers / the --token option, but perhaps you're better versed in that code base? Either way I'm diving in.

[briantist]

ahhh I just had an idea: maybe (similar to the verbosity option) it's a matter of position? In your OP you have --token after the collection path, but it should probably be before

$ ansible-galaxy collection publish --help
usage: ansible-galaxy collection publish [-h] [-s API_SERVER] [--token API_KEY] [-c] [-v] [--no-wait]
                                         [--import-timeout IMPORT_TIMEOUT]
                                         collection_path

[onefourfive]

oh would that it were so simple! I gave that a try, order matching the ansible-galaxy help usage:

ansible-galaxy collection publish -s local --token $ARTAPI_TOKEN my_demo-collection_demo-1.0.0.tar.gz

but that yields the same Authorization-less header it seems

galactory-1  | INFO:werkzeug:10.10.12.65 - - [31/May/2024 22:15:51] "GET /api HTTP/1.1" 200 -
galactory-1  | INFO:galactory:authorize() called.
galactory-1  |   apikey=  None
galactory-1  |   auth header= None
galactory-1  | INFO:galactory:header info: Accept-Encoding: identity
galactory-1  | Host: galaxy.demo.org:8088
galactory-1  | User-Agent: ansible-galaxy/2.16.3 (Linux; python:3.12.3)
galactory-1  | Content-Type: multipart/form-data; boundary="===============9031658227851557661=="
galactory-1  | Content-Length: 44480
galactory-1  | Connection: close

[onefourfive]

Answering my own question here-- this an open bug in ansible since (at least) 2.15! ansible/ansible#81698

For a token to even be included in the request to a private / custom Galaxy server, it must be specified in ansible.cfg explicitly.

Working:

[galaxy]
server_list = local

[galaxy_server.local]
url = "http://galaxy.demo.org:8088/"
token = WholeTokenExplicitlyHere

ansible-galaxy collection publish collection-ver.tgz

Not working:

• Using token_path in ansible.cfg in any case, even with --token on commandline

In this case no token is provided and the Authorization header is never sent.

[briantist]

Nice catch! It was also suggested in that issue that you can use the environment variable.

Another option that's even less documented is to put the token in a file in ~/.ansible/galaxy_token.

Despite the lack of extension, that file is actually YAML, and its format is like this:

token: WholeTokenExplicitlyHere

This is actually the file I used for my local testing way back, but I did not expect --token to silently be ignored.

It seems that this file might actually not be recommended though according to this:

• How am I supposed to pass galaxy_token? ansible/ansible#82260 (comment)

The way I found out about it originally was with verbose output on ansible-galaxy

Initial connection to galaxy_server: https://galaxy.ansible.com
Opened /home/briantist/.ansible/galaxy_token
Calling Galaxy at https://galaxy.ansible.com/api/

---

Anyway, I'm glad this was figured out, and I'm sorry for the trouble. I hope the experience with galactory is smoother from here on out!