(maint) Accept ARTIFACTORY_ACCESS_TOKEN in check_authorization#1277
Closed
isaac-jha wants to merge 1 commit into
Closed
(maint) Accept ARTIFACTORY_ACCESS_TOKEN in check_authorization#1277isaac-jha wants to merge 1 commit into
isaac-jha wants to merge 1 commit into
Conversation
JFrog deprecated API-key authentication and blocked new API-key creation in Artifactory 7.98. The bundled puppet-artifactory-client SDK already accepts an access token via the ARTIFACTORY_ACCESS_TOKEN env var, but check_authorization here only recognized ARTIFACTORY_USERNAME/PASSWORD or ARTIFACTORY_API_KEY. Callers that had migrated to a scoped access token or reference token would hit the "unable to determine credentials" error even though the underlying SDK would authenticate fine. Add ARTIFACTORY_ACCESS_TOKEN to the accepted set and update the error message to guide new callers toward it while noting ARTIFACTORY_API_KEY as deprecated. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
Author
|
Closing — team no longer uses this repo; equivalent fix will land in packaging-private only. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
check_authorizationinlib/packaging/artifactory.rbnow acceptsARTIFACTORY_ACCESS_TOKENalongside the existingARTIFACTORY_USERNAME/ARTIFACTORY_PASSWORDandARTIFACTORY_API_KEYvariants.ARTIFACTORY_ACCESS_TOKENand note thatARTIFACTORY_API_KEYis deprecated by JFrog.aroundhook that isolates env-var state per example.Why
JFrog deprecated API-key authentication and blocked new API-key creation starting with Artifactory 7.98. The bundled
puppet-artifactory-clientSDK already accepts an access token viaARTIFACTORY_ACCESS_TOKEN(seelib/artifactory/defaults.rb/lib/artifactory/client.rbin that repo — the auth precedence there is username+password → access_token → api_key). But this gem'scheck_authorizationonly recognized the old set, so any caller that migrated to a scoped access token or reference token would hit the "Unable to determine credentials" error even though the underlying SDK would authenticate fine.This is a prerequisite for the on-prem Artifactory upgrade to 7.146.x — we need callers to be able to run against a new access token without changing this gem's semantics for existing callers.
Test plan
bundle exec rspec spec/lib/packaging/artifactory_spec.rb— 66 examples, 0 failures locally.Notes
ARTIFACTORY_API_KEYremains fully supported for backwards compatibility until existing callers migrate. No behavior change for them.🤖 Generated with Claude Code