Repository navigation
[Bug]: registry login fails with 401 against JFrog Artifactory (Bearer token flow); same requests succeed with curl #2420
Description
I have done the following
- I have searched the existing issues
- If possible, I've reproduced the issue using the 'main' branch of this project
(Not reproduced on main, but the registry client code involved is the same: RegistryClient.swift, RegistryClient+Token.swift, and Authentication.swift in containerization 0.52.1 are identical to main.)
Steps to reproduce
- Have a JFrog Artifactory instance that serves the Docker registry API with Bearer token auth.
GET /v2/returns:WWW-Authenticate: Bearer realm="https://<host>/v2/token",service="<host>" - Run:
or
container registry login <host> -u <user>read -rs PW && printf '%s' "$PW" | container registry login --username <user> --password-stdin <host>; unset PW
Problem description
The login fails:
Error: HTTP request to https://<host>/v2/ failed with response: 401 Unauthorized. Reason: access denied or wrong credentials
The same credentials work with curl on every step of the flow that RegistryClient uses:
| Request | Result |
|---|---|
GET /v2/ with Basic auth |
200 |
GET /v2/token?client_id=containerization-registry-client&service=<host>, Basic auth, User-Agent: containerization-registry-client |
200, JSON with token, no WWW-Authenticate header on the response |
GET /v2/ with Authorization: Bearer <token> from that response |
200 |
| The token request over IPv4 and IPv6, HTTP/1.1 and HTTP/2 | 200 |
The token request against each of the host's 8 A records (curl --resolve) |
200 |
A token with scope=registry:catalog:*, then GET /v2/ with it |
200 |
POST /v2/token (OAuth2 grant_type=password) |
401. Artifactory does not support it, but RegistryClient uses GET, so this should not matter. |
No proxy is configured, neither in the shell environment nor in the system settings (scutil --proxy), and curl --noproxy '*' also returns 200. A previous container registry logout <host> does not change the result.
From the code, "access denied or wrong credentials" for /v2/ comes from the token exchange (fetchToken) returning 401/403, or from /v2/ still returning 401 with the token. The server accepts both requests from curl. So I expect the login to succeed.
container --debug registry login … prints nothing beyond the error, and container system logs shows nothing for the login. How can I get a trace of the requests and responses of the token exchange from the client, to find the difference?
Environment
- OS: macOS 27.0.1 (26A434)
- Xcode: 27.1 (27A9275)
- Container: container CLI version 1.6.0 (build: release, commit: ca4884f), containerization 0.52.1
Code of Conduct
- I agree to follow this project's Code of Conduct
Activity