dotnet restore, with HTTP_PROXY and HTTPS_PROXY (with user/password) broken again #6978

livarcocc · 2018-05-28T19:00:07Z

From @tebeco on May 28, 2018 14:11

Steps to reproduce

setup an NTLM proxy
add a Nuget.Config with

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <config>
    <add key="dependencyVersion" value="Highest" />
    <add key="no_proxy"    value="*.yourCorp" />
  </config>
 <packageSources>
    <!--To inherit the global NuGet package sources remove the <clear/> line below -->
    <clear />
    <add key="nuget" value="https://api.nuget.org/v3/index.json" />
    <add key="corpFeed" value="https://yourfeed.yourCorp" />
...
 </packageSources>
</configuration>

Setup proxy in your shell

$> set HTTP_PROXY=http://user:password@your-proxy:port
$> set HTTPS_PROXY=http://user:password@your-proxy:port

$> dotnet restore

try nuget for fun

$> nuget
NuGet Version: 4.6.0.4971

$> >nuget restore YOUR_PROJECT.csproj
 .... IT WORKS

soooooo anyone know how to make dotnet restore works behind an NTLM proxy ?

NUGET is OK

PAKET is OK (without any env var)

DOTNET ... was ok ... with only proxy URL

DOTNET is KO without env var

DOTNET is KO with env var

DOTNET is KO with env var + user / password in the NTLM proxy url (no special character in either user or password)

Expected behavior

... it should work

Actual behavior

All internal feed nugets are OK and restored
dotnet still fails behind proxy

C:\Program Files\dotnet\sdk\2.1.300-rc1-008673\NuGet.targets(114,5): error : Unable to load the service index for source https://api.nuget.org/v3/index.json. [D:\xxxxxx\xxxxxx.csproj]
C:\Program Files\dotnet\sdk\2.1.300-rc1-008673\NuGet.targets(114,5): error :   Response status code does not indicate success: 407 (authenticationrequired). [D:\xxxxxx\xxxxxx.csproj]

Environment data

>dotnet --info
.NET Core SDK (reflecting any global.json):
 Version:   2.1.300-rc1-008673
 Commit:    f5e3ddbe73

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.15063
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\2.1.300-rc1-008673\

Host (useful for support):
  Version: 2.1.0-rc1
  Commit:  eb9bc92051

.NET Core SDKs installed:
  2.1.4 [C:\Program Files\dotnet\sdk]
  2.1.100 [C:\Program Files\dotnet\sdk]
  2.1.101 [C:\Program Files\dotnet\sdk]
  2.1.102 [C:\Program Files\dotnet\sdk]
  2.1.103 [C:\Program Files\dotnet\sdk]
  2.1.104 [C:\Program Files\dotnet\sdk]
  2.1.105 [C:\Program Files\dotnet\sdk]
  2.1.200 [C:\Program Files\dotnet\sdk]
  2.1.201 [C:\Program Files\dotnet\sdk]
  2.1.300-rc1-008673 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.All 2.1.0-rc1-final [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.0-rc1-final [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.0.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.0.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.0-rc1 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]

To install additional .NET Core runtimes or SDKs:
  https://aka.ms/dotnet-download

Copied from original issue: dotnet/cli#9358

The text was updated successfully, but these errors were encountered:

livarcocc · 2018-05-28T19:00:08Z

From @tebeco on May 28, 2018 14:15

Just to be clear ... i also tried nuget.config to set
http_proxy https_proxy no_proxy

also if i have to provide ANY user and password ... it is not compliant with any form of "Continuous" integration right ?

setting up a proxy as an env var :

Globally ==> will mess up all tool that read it and will try to access any internal url with the proxy, wich is forbiden
In the process
- it means i'll have to use a Vault to store user / password ?
- it means i'll have to code the logic that will
  - fetch Vault cred
  - get values
  - set value in the shell
  - run dotnet restore
  - unset it ?
  - take care of NO_PROXY

DaniilSokolyuk · 2018-05-31T09:21:52Z

we have same problem :( after install dotnet sdk 2.1.300
but we using global proxy (Internet options on windows) and its works fine on sdk 2.1.200

galakt · 2018-05-31T11:21:47Z

Holy cow, not again please

tebeco · 2018-05-31T11:25:16Z

It’s been broken since alpha of dotnet cli.
As Nuget CLI works without having to set HTTP_PROXY
dotnet forced us to set it globally ... wtf seriously ?

now it is even worse since this is not working anymore in dotnet

tebeco · 2018-06-03T17:39:43Z

@livarcocc @anangaur
who should we ping to get answer on that one, this is still a blocker for Corporation right ?

anangaur · 2018-06-03T23:06:33Z

Related #6761
/cc: @rrelyea @nkolev92

tebeco · 2018-06-04T06:13:12Z

i tried without the password it still break
i tried with a username and password that only contains letter lower and upper and digit
still break

tebeco · 2018-06-04T06:21:12Z

if only it was easy to create a docker images in order to diagnostic that
it could be a Mandatory test in the Integrration test in the CI of both nuget and dotnet
i have no idea how to create an NTML pro y using windows containers so i could make it run in docker :s

livarcocc · 2018-06-04T20:10:04Z

@rohit21agrawal @nkolev92

tebeco · 2018-06-04T20:12:11Z

After reading myself later deeply apologize about the way the things ended up here :s
will be more positive as possible ;)

nkolev92 · 2018-06-04T21:28:39Z

Not sure what's going wrong here.

@tebeco
We need to investigate deeper.

Can you please try msbuild /t:restore? Not dotnet msbuild, but the VS built in one.

devcrafting · 2018-06-05T08:31:13Z

Same problem here with 2.1.300 final release.
Tried nuget.exe restore (4.7.0.5148, the same version dotnet sdk uses), it works. So the problem would be more on https://github.com/dotnet/cli/issues/9358, no ?

tebeco · 2018-06-05T17:31:00Z

@livarcocc
https://github.com/tebeco/CheckHttpProxyNetCoreApp21

Is that what we were talking about yesterday ?

====
my tests on msbuild /t:restore were irrelevant as i forgot to clear all caches locally
I have to leae works i will test again tomorrow

tebeco · 2018-06-05T17:36:56Z

is there anyone that knows if there's a Windows Container (probably nano server) that exists with a simple user/password with an NTLM proxy, so i could test it on my personnal laptop without beeing restricted by work hours ^^

tmds · 2018-06-06T11:14:33Z

Maybe this is an issue with the new SocketsHttpHandler. You can use the 2.0 http handler by setting DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER to 0.

SirinivasK · 2018-06-06T13:30:04Z

I am also facing the same issue. I am struggling to find a solution for last two days. This is a blocker for me at the moment. I tried setting up the http_proxy/https_proxy with the username but still no luck.
This is how my docker file looks like:
FROM microsoft/aspnetcore:2.0-nanoserver-sac2016 AS base
WORKDIR /app
EXPOSE 80

FROM microsoft/aspnetcore-build:2.0-nanoserver-sac2016 AS build
WORKDIR /src
COPY IdSvr/IdSvr.csproj IdSvr/
RUN dotnet restore IdSvr.csproj
COPY . .
WORKDIR /src/IdSvr
RUN dotnet build IdSvr.csproj -c Release -o /app

FROM build AS publish
RUN dotnet publish IdSvr.csproj -c Release -o /app

FROM base AS final
WORKDIR /app
COPY --from=publish /app .
ENTRYPOINT ["dotnet", "IdSvr.dll"]

Output:
Step 7/16 : RUN dotnet restore IdSvr/IdSvr.csproj
---> Running in 244dbef710b6
Restoring packages for C:\src\IdSvr\IdSvr.csproj...
Restoring packages for C:\src\IdSvr\IdSvr.csproj...
Restore completed in 10.46 sec for C:\src\IdSvr\IdSvr.csproj.
C:\Program Files\dotnet\sdk\2.1.200\NuGet.targets(114,5): error : Unable to load the service index for source https://api.nuget.org/v3/index.json. [C:\src\IdSvr\IdSvr.csproj]
C:\Program Files\dotnet\sdk\2.1.200\NuGet.targets(114,5): error : An error occurred while sending the request. [C:\src\IdSvr\IdSvr.csproj]
C:\Program Files\dotnet\sdk\2.1.200\NuGet.targets(114,5): error : The operation timed out [C:\src\IdSvr\IdSvr.csproj]
ERROR: Service 'idsvr' failed to build: The command 'powershell -Command $ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue'; dotnet restore IdSvr/IdSvr.csproj' returned a non-zero code: 1

Note:
on my local, sdk 2.0.0 installed by default, but while trying to restore it is pointing to 2.1.200 which is not installed on my machine.

anangaur · 2018-06-06T14:55:08Z

/cc: @rrelyea

nkolev92 · 2018-06-06T23:37:14Z

If nuget.exe works, but dotnet.exe restore doesn't (please make sure you clean all the caches as @tebeco
mentioned, nuget locals or dotnet nuget locals), can you please test whether msbuild.exe works?

That'll help us a lot toward diagnosing this issue.

If you went through the above, and msbuild.exe works, please try setting DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER=0. as @tmds recommended and let us know what you encountered.

tebeco · 2018-06-07T07:04:46Z

@nkolev92 so if i set a proxy (using a PAC Script) in IE (Win10)
the following should works ?
nuget seems perfectly ok that moby ever set HTTP_PROXY
never seen dotnet works since a long time without it)

SET DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER=0
SET HTTP_PROXY=
SET HTTPS_PROXY=
dotnet nuget locals -c all
dotnet restore

will test that today

diegotrujillor · 2018-06-07T16:37:12Z

Trying the @tebeco and @nkolev92 proposed above thread I got this error on dotnet restore:

Unhandled Exception: System.TypeInitializationException: The type initializer for 'Ssl' threw an exception. ---> System.TypeInitializationException: The type initializer for 'SslInitializer' threw an exception. ---> Interop+Crypto+OpenSslCryptographicException: error:0B07C065:x509 certificate routines:X509_STORE_add_cert:cert already in hash table
at Interop.SslInitializer..cctor()
--- End of inner exception stack trace ---
at Interop.Ssl..cctor()
--- End of inner exception stack trace ---
at Interop.Ssl.SetProtocolOptions(IntPtr ctx, SslProtocols protocols)
at System.Net.Http.CurlHandler.SslProvider.SslCtxCallback(IntPtr curl, IntPtr sslCtx, IntPtr userPointer)
at Interop.Http.MultiPerform(SafeCurlMultiHandle multiHandle)
at System.Net.Http.CurlHandler.MultiAgent.PerformCurlWork()
at System.Net.Http.CurlHandler.MultiAgent.WorkerBodyLoop()

tebeco · 2018-06-07T16:59:27Z

@nkolev92

TL;DR)
nuget restore : OK
dotnet restore: KO with a 407

Details :

D:\>dotnet new console -n deleteme
D:\>cd deleteme
D:\>dotnet new nugetconfig

edit the nuget.config and replace with :

<?xml version="1.0" encoding="utf-8"?>
<configuration>
 <packageSources>
    <!--To inherit the global NuGet package sources remove the <clear/> line below -->
    <clear />

    <add key="nuget" value="https://api.nuget.org/v3/index.json" />
 </packageSources>
</configuration>

edit the csproj :

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>netcoreapp2.1</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="MarbleTest.Net" Version="[1.4.0, )" />
  </ItemGroup>

</Project>

D:\deleteme>dotnet nuget locals -c all
info : Clearing NuGet HTTP cache: C:\Users\xxx\AppData\Local\NuGet\v3-cache
info : Clearing NuGet global packages cache: C:\Users\xxx\.nuget\packages\
info : Clearing NuGet Temp cache: C:\Users\xxx\AppData\Local\Temp\NuGetScratch
info : Local resources cleared.


D:\deleteme>SET DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER=0

D:\deleteme>SET HTTP_PROXY=

D:\deleteme>SET HTTPS_PROXY=

D:\deleteme>dotnet restore
  Restoring packages for D:\deleteme\deleteme.csproj...
C:\Program Files\dotnet\sdk\2.1.300\NuGet.targets(114,5): error : Unable to load the service index for source https://api.nuget.org/v3/index.json. [D:\deleteme\deleteme.csproj]
C:\Program Files\dotnet\sdk\2.1.300\NuGet.targets(114,5): error :   Response status code does not indicate success: 407 (authenticationrequired). [D:\deleteme\deleteme.csproj]





D:\deleteme>nuget restore deleteme.csproj
MSBuild auto-detection: using msbuild version '15.7.179.6572' from 'C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise\MSBuild\15.0\bin'.
Restoring packages for D:\deleteme\deleteme.csproj...
  GET https://api.nuget.org/v3-flatcontainer/marbletest.net/index.json
  OK https://api.nuget.org/v3-flatcontainer/marbletest.net/index.json 714ms
  GET https://api.nuget.org/v3-flatcontainer/marbletest.net/1.4.0/marbletest.net.1.4.0.nupkg
  OK https://api.nuget.org/v3-flatcontainer/marbletest.net/1.4.0/marbletest.net.1.4.0.nupkg 755ms
  GET https://api.nuget.org/v3-flatcontainer/microsoft.reactive.testing/index.json
  GET https://api.nuget.org/v3-flatcontainer/system.reactive/index.json
  OK https://api.nuget.org/v3-flatcontainer/microsoft.reactive.testing/index.json 508ms
  GET https://api.nuget.org/v3-flatcontainer/microsoft.reactive.testing/3.1.1/microsoft.reactive.testing.3.1.1.nupkg
  OK https://api.nuget.org/v3-flatcontainer/system.reactive/index.json 577ms
  GET https://api.nuget.org/v3-flatcontainer/system.reactive/3.1.1/system.reactive.3.1.1.nupkg
  OK https://api.nuget.org/v3-flatcontainer/system.reactive/3.1.1/system.reactive.3.1.1.nupkg 731ms
  GET https://api.nuget.org/v3-flatcontainer/system.reactive.platformservices/index.json
  OK https://api.nuget.org/v3-flatcontainer/microsoft.reactive.testing/3.1.1/microsoft.reactive.testing.3.1.1.nupkg 1179ms
  OK https://api.nuget.org/v3-flatcontainer/system.reactive.platformservices/index.json 500ms
  GET https://api.nuget.org/v3-flatcontainer/system.reactive.platformservices/3.1.1/system.reactive.platformservices.3.1.1.nupkg
  OK https://api.nuget.org/v3-flatcontainer/system.reactive.platformservices/3.1.1/system.reactive.platformservices.3.1.1.nupkg 820ms
  GET https://api.nuget.org/v3-flatcontainer/system.reactive.linq/index.json
  OK https://api.nuget.org/v3-flatcontainer/system.reactive.linq/index.json 557ms
  GET https://api.nuget.org/v3-flatcontainer/system.reactive.linq/3.1.1/system.reactive.linq.3.1.1.nupkg
  OK https://api.nuget.org/v3-flatcontainer/system.reactive.linq/3.1.1/system.reactive.linq.3.1.1.nupkg 882ms
  GET https://api.nuget.org/v3-flatcontainer/system.reactive.core/index.json
  GET https://api.nuget.org/v3-flatcontainer/system.runtime.interopservices.windowsruntime/index.json
  OK https://api.nuget.org/v3-flatcontainer/system.runtime.interopservices.windowsruntime/index.json 494ms
  OK https://api.nuget.org/v3-flatcontainer/system.reactive.core/index.json 497ms
  GET https://api.nuget.org/v3-flatcontainer/system.runtime.interopservices.windowsruntime/4.0.1/system.runtime.interopservices.windowsruntime.4.0.1.nupkg
  GET https://api.nuget.org/v3-flatcontainer/system.reactive.core/3.1.1/system.reactive.core.3.1.1.nupkg
  OK https://api.nuget.org/v3-flatcontainer/system.runtime.interopservices.windowsruntime/4.0.1/system.runtime.interopservices.windowsruntime.4.0.1.nupkg 861ms
  OK https://api.nuget.org/v3-flatcontainer/system.reactive.core/3.1.1/system.reactive.core.3.1.1.nupkg 972ms
  GET https://api.nuget.org/v3-flatcontainer/system.reactive.interfaces/index.json
  GET https://api.nuget.org/v3-flatcontainer/system.componentmodel/index.json
  OK https://api.nuget.org/v3-flatcontainer/system.componentmodel/index.json 511ms
  GET https://api.nuget.org/v3-flatcontainer/system.componentmodel/4.0.1/system.componentmodel.4.0.1.nupkg
  OK https://api.nuget.org/v3-flatcontainer/system.reactive.interfaces/index.json 534ms
  GET https://api.nuget.org/v3-flatcontainer/system.reactive.interfaces/3.1.1/system.reactive.interfaces.3.1.1.nupkg
  OK https://api.nuget.org/v3-flatcontainer/system.reactive.interfaces/3.1.1/system.reactive.interfaces.3.1.1.nupkg 747ms
  OK https://api.nuget.org/v3-flatcontainer/system.componentmodel/4.0.1/system.componentmodel.4.0.1.nupkg 883ms
Installing System.ComponentModel 4.0.1.
Installing System.Reactive.Interfaces 3.1.1.
Installing System.Reactive.Core 3.1.1.
Installing System.Runtime.InteropServices.WindowsRuntime 4.0.1.
Installing System.Reactive.Linq 3.1.1.
Installing System.Reactive.PlatformServices 3.1.1.
Installing Microsoft.Reactive.Testing 3.1.1.
Installing System.Reactive 3.1.1.
Installing MarbleTest.Net 1.4.0.
Committing restore...
Generating MSBuild file D:\deleteme\obj\deleteme.csproj.nuget.g.props.
Generating MSBuild file D:\deleteme\obj\deleteme.csproj.nuget.g.targets.
Writing lock file to disk. Path: D:\deleteme\obj\project.assets.json
Restore completed in 10.22 sec for D:\deleteme\deleteme.csproj.

NuGet Config files used:
    D:\deleteme\NuGet.Config
    C:\Users\xxx\AppData\Roaming\NuGet\NuGet.Config
    C:\Program Files (x86)\NuGet\Config\Microsoft.VisualStudio.Offline.config

Feeds used:
    https://api.nuget.org/v3/index.json

Installed:
    9 package(s) to D:\deleteme\deleteme.csproj

tebeco · 2018-06-07T17:53:42Z

Is it possible to change the title to something that does not involve either
username
password
or env var

something like this (there’s probably a better title ^^) :
embedded nuget version of dotnet 2.1.300 does not handle windows NTLM proxy settings (settings in Internet explorer panel)

nkolev92 · 2018-06-11T22:07:02Z

@tebeco
Can you please try msbuild /t:restore?
The .NET Framework version, not the dotnet msbuild one.

tebeco · 2018-06-11T22:22:56Z

last time i used it, it was from vs2017 prompt for devs and where msbuild pointes to some folder in program files
was that the good one ?

nkolev92 · 2018-06-11T22:23:33Z

@tebeco
Yes that's it.

Easiest approach is to go to the developer command prompt and run
"msbuild /t:restore"

tebeco · 2018-06-12T06:30:14Z

if i understand correctly this issue has been splitted into at least 2 issue ?
one for servicing as a regression for WinHttpHandler (is it the 2.1.1 ?)
the other for SockerXXXXHandler ?

do you need network trace for the SocketHandler to avoid discovering a new weird scenario ? if so how could i help to get these traces

tebeco · 2018-06-25T15:45:00Z

@nkolev92 back from holidays,
do you need any new test / answer or anything else to helps you about this one ?

nkolev92 · 2018-06-25T18:24:09Z

@tebeco
Please refer to #5358 (comment)

Tracking issue on corefx side https://github.com/dotnet/corefx/issues/30354

tebeco · 2018-08-02T17:35:55Z

hi again
i just tested this morning with 2.1.401-xxxxx (the “final preview”)

this photo is the result of my attempt

after few investigation and playing around with fiddler, a colleague of mine pointed out that :

our proxy is NTLM (header in the 407)
the proxy in http (not https)
when we access https is has to do a CONNECT (tunneling https inside http for the proxy)
the http client only (from the capture) does the first request then nothing more

Roman-Tarasiuk · 2019-01-31T08:10:13Z

In my Windows 10, I run commands:
nuget.exe config -set http_proxy=http://proxy:port
nuget.exe config -set http_proxy.user=username
These settings are found in C:\Users\username\AppData\Roaming\NuGet\NuGet.Config
I did not set password (i did before using nuget.exe config -set http_proxy.password=userPassword, but it did not work for me, and I have removed string from the file).
Maybe – I do not know, I think – it uses saved password from Control Panel | User Accounts | Manage Windows Cridentials, the value git:http://username@proxy:port – it asked me the password when I run git pull/push.
After that I run dotnet restore and it successfully finished.

tebeco · 2019-01-31T08:14:52Z

i understand that on the paper it works.

in reality you have 4-5 feed
some on nuget.org (require proxy + ad auth)
some in the LAN (http bad gateway if you use that settings ... logical)
some feed on vsts (need another proxy and probably auth too)

i’m order to do a dotnet restore on the aspnetcore repo i had to create like 8 artifactory proxy (cost money because of a handshake not handled at tcp/http level)

and even with that it still not work properly

as i understand that setup affect the all machine this is good in very limited scenario but it does not scale well

i would love to have a simple way to customize this per feed because this is the only thing that matter, not a huge global state of rule affecting every single feed

steelcg · 2019-06-19T00:41:41Z

This my successful soulution:

download the nuget.exe from http://www.nuget.org
excute command:
nuget config -Set http_proxy="http://proxy.com:port" -Set http_proxy.user="username" -Set http_proxy.password="password"
then you can see some configs in nuget.config file.
try to exec "dotnet add " command and you will get the success.

i think the most important thing is the password need to set by nuget config -Set command, not add manully.

tebeco · 2019-06-19T04:57:09Z

or never enter either username and password.
open an issue on github and ask if it's possible to let the httpclient handle the NTLM Challenge properly using the current user for the NetworkCredential.

that way you never need to specify either a password or a username.
good thing about it :

you don't leak a username
you don't leak potential password if you do it bad (manually)
you don't need to add NO_PROXY
you won't block you account when password change because it will do more than 3 attempt
it will work out of the box with absolutely 0 change or 0 manual manipulation

zarenner · 2019-08-02T22:33:32Z

Looking at the code, it appears that only the user-level config works for proxy settings. This matches the behavior I see, at least on dotnet 2.2.401.

nkolev92 · 2019-08-02T22:46:52Z

Thanks @zarenner
I've noticed that too, right now I'm having finding the issue calling that out.

That could be the root cause of some of the issues in this thread (Unfortunately I'm not confident everyone on this thread is hitting the same issues.

edit Of course I find it after I comment :D #747
edit 2 Seems like you found that one too :D

dennisvanderpool · 2019-10-08T11:48:34Z

In my Windows 10, I run commands:
nuget.exe config -set http_proxy=http://proxy:port nuget.exe config -set http_proxy.user=username
These settings are found in C:\Users\username\AppData\Roaming\NuGet\NuGet.Config
I did not set password (i did before using nuget.exe config -set http_proxy.password=userPassword, but it did not work for me, and I have removed string from the file).
Maybe – I do not know, I think – it uses saved password from Control Panel | User Accounts | Manage Windows Cridentials, the value git:http://username@proxy:port – it asked me the password when I run git pull/push.
After that I run dotnet restore and it successfully finished.

This worked for me, thanks.

ganeshgk · 2020-03-28T19:50:53Z

@tebeco any clue / solution to get this working on CentOS, tried all the above methods. Setting DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER to zero gives authentication required. Unsetting gives an error related to GSSAPI error. Going crazy over this. Both dotnet 2.2 & 3 have the same error

tebeco · 2020-03-28T20:08:03Z

Setting DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER to zero gives authentication required

I'm not surprised, on windows disabling this one could help re-enable the WinHttpSockerHandler (can't remember the real name) that could (in netfx) handle Authentication based on the user logged in.

Unsetting gives an error related to GSSAPI error.

I'll be honest i have no idea what it is and that it existed.

To be fair, i found literally no clean solution if the proxy is an explicit proxy.
The only way we had it working was to create an on premise "nuget gateway"

As we have hundreds of teams releasing nugets internally we had/have either Sonatype Nexus / JFrog Artifactory and we created Remote repository that points to nuget.org.
These "on premise" feeds would have the authenticated proxy setup (service account with internet right for example)
These would be anonymous and in LAN only, all you would have to do is stop using nuget.org and replace it with that feed URL in the LAN

It have LOTS of inconvenience ... like :

if you try to restore repo like dotnet/aspnetcore, it reliad on like ~4-5 remote so you need t create 1 for each
some repo relies on azure blob as a feed
Artifactory does not seem to be compliant with feedz.io
...

for regular and limited remote feed, that works, but it does not scale well. I often fork / clone repo like dotnet/aspnetcore dotnet/runtime or azure/azure-signalr and that's very very hard to make it restore everything properly
and there's also the tooling from dotnet/arcade ....

tebeco · 2020-04-10T14:37:47Z

to be fair, this issue could potentially be fixed if there's a way to add specific code in the Windows binary to support PAC proxy and "IE Proxy"
see #6981

One of the Issue with HTTP_PROXY could be explicit proxy, and it could often be NTLM proxy (expliciy user/pass/domain in clear)

It leads used toward custom alias / handling password changes every XX weeks / that could also trigger Account Locked because the password changed but you forgot that one script.

HTTP_PROXY and HTTPS_PROXY are very limited for such scenario :(

DrStrangepork · 2020-04-15T23:29:48Z

This helped me with this problem on Ubuntu - https://github.com/dotnet/core/blob/master/Documentation/linux-setup.md - specifically:

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
export SSL_CERT_DIR=/dev/null

perhaps the equivalent on Windows will help the Windows folks

nkolev92 · 2020-04-16T20:06:47Z

Hey all,

Thank you for this discussion. Apologies for not being able to get to all of your feedback.
At this point I think that this discussion has gone into a few different directions.

A few takeaways from what I am noticing:

NuGet.exe/MSBuild.exe worked better for folks than dotnet.exe.
A lot of the issues were related to: SocketsHttpHandler throws exception when authenticating proxy or server closes first 407 response dotnet/runtime#26461, which has been fixed since then.
There are still difficulties configuring different types of proxy, specifically ntlm proxy, which is something that @tebeco has raised in Improved proxy support in the NuGet.Clients (ntlm proxy, etc) #6981.

As such I'm gonna to close this issue, as given the number of different directions we've gone it'd be difficult to get clarity on every single problem.

Please file individual problems for the specific issues that you are facing.

Please check the following 2 issues before filing:

arcanosam · 2022-08-01T13:46:56Z

It's correlated, but not the same cenario here, but I would like to document for those on Linux.

I'm on Fedora 35 using VsCode and dotnet sdk 6 installed

To use dotnet add package behind proxy I have to use this format of command:

export http_proxy=http://[user]:[pass]@[server]:[port] && dotnet add package <package>

tebeco mentioned this issue May 29, 2018

Nuget CLI does not support dotnet-tool #6982

Closed

nkolev92 added Area:Authentication Product:dotnet.exe Triage:Investigate labels Jun 4, 2018

nkolev92 added the WaitingForCustomer Applied when a NuGet triage person needs more info from the OP label Jun 6, 2018

nkolev92 mentioned this issue Jun 15, 2018

dotnet restore failure, nuget restore success with same configuration behind proxy #7032

Closed

nkolev92 added Resolution:BlockedByExternal Progress on this task is blocked by an external issue. When that issue is completed this can proceed and removed Triage:Investigate WaitingForCustomer Applied when a NuGet triage person needs more info from the OP labels Jun 25, 2018

nkolev92 added the Area:HttpCommunication label Sep 17, 2018

rrelyea mentioned this issue Oct 1, 2018

"dotnet restore" does not honor proxy settings in local "nuget.config" #7332

Closed

Cronan mentioned this issue May 3, 2019

Proxy dotnet/symstore#96

Open

heng-liu added the Pipeline: New Issues label Apr 9, 2020

zkat assigned nkolev92 Apr 16, 2020

zkat added the Priority:2 Issues for the current backlog. label Apr 16, 2020

nkolev92 closed this as completed Apr 16, 2020

nkolev92 mentioned this issue Apr 17, 2020

no basic auth header when using proxy v2.1.300-preview1-62608--07 #6939

Closed

Livius90 mentioned this issue Nov 19, 2022

add Python.NET recipe DynamicDevices/meta-mono#159

Merged

dotnet restore, with HTTP_PROXY and HTTPS_PROXY (with user/password) broken again #6978

dotnet restore, with HTTP_PROXY and HTTPS_PROXY (with user/password) broken again #6978

Comments

livarcocc commented May 28, 2018

Steps to reproduce

NUGET is OK

PAKET is OK (without any env var)

DOTNET ... was ok ... with only proxy URL

DOTNET is KO without env var

DOTNET is KO with env var

DOTNET is KO with env var + user / password in the NTLM proxy url (no special character in either user or password)

Expected behavior

Actual behavior

Environment data

livarcocc commented May 28, 2018

DaniilSokolyuk commented May 31, 2018 • edited Loading

galakt commented May 31, 2018

tebeco commented May 31, 2018 • edited Loading

tebeco commented Jun 3, 2018

anangaur commented Jun 3, 2018

tebeco commented Jun 4, 2018 • edited Loading

tebeco commented Jun 4, 2018 • edited Loading

livarcocc commented Jun 4, 2018

tebeco commented Jun 4, 2018

nkolev92 commented Jun 4, 2018 • edited Loading

devcrafting commented Jun 5, 2018

tebeco commented Jun 5, 2018 • edited Loading

tebeco commented Jun 5, 2018 • edited Loading

tmds commented Jun 6, 2018

SirinivasK commented Jun 6, 2018

anangaur commented Jun 6, 2018

nkolev92 commented Jun 6, 2018

tebeco commented Jun 7, 2018 • edited Loading

diegotrujillor commented Jun 7, 2018

tebeco commented Jun 7, 2018 • edited Loading

tebeco commented Jun 7, 2018 • edited Loading

nkolev92 commented Jun 11, 2018

tebeco commented Jun 11, 2018

nkolev92 commented Jun 11, 2018

tebeco commented Jun 12, 2018

tebeco commented Jun 25, 2018

nkolev92 commented Jun 25, 2018 • edited Loading

tebeco commented Aug 2, 2018

Roman-Tarasiuk commented Jan 31, 2019 • edited Loading

tebeco commented Jan 31, 2019 • edited Loading

steelcg commented Jun 19, 2019 • edited Loading

tebeco commented Jun 19, 2019 • edited Loading

zarenner commented Aug 2, 2019

nkolev92 commented Aug 2, 2019 • edited Loading

dennisvanderpool commented Oct 8, 2019

ganeshgk commented Mar 28, 2020

tebeco commented Mar 28, 2020

tebeco commented Apr 10, 2020 • edited Loading

DrStrangepork commented Apr 15, 2020

nkolev92 commented Apr 16, 2020

arcanosam commented Aug 1, 2022 • edited Loading

DaniilSokolyuk commented May 31, 2018 •

edited

Loading

tebeco commented May 31, 2018 •

edited

Loading

tebeco commented Jun 4, 2018 •

edited

Loading

tebeco commented Jun 4, 2018 •

edited

Loading

nkolev92 commented Jun 4, 2018 •

edited

Loading

tebeco commented Jun 5, 2018 •

edited

Loading

tebeco commented Jun 5, 2018 •

edited

Loading

tebeco commented Jun 7, 2018 •

edited

Loading

tebeco commented Jun 7, 2018 •

edited

Loading

tebeco commented Jun 7, 2018 •

edited

Loading

nkolev92 commented Jun 25, 2018 •

edited

Loading

Roman-Tarasiuk commented Jan 31, 2019 •

edited

Loading

tebeco commented Jan 31, 2019 •

edited

Loading

steelcg commented Jun 19, 2019 •

edited

Loading

tebeco commented Jun 19, 2019 •

edited

Loading

nkolev92 commented Aug 2, 2019 •

edited

Loading

tebeco commented Apr 10, 2020 •

edited

Loading

arcanosam commented Aug 1, 2022 •

edited

Loading