Nexus 3.6.0 Enabling Docker Anonymous Support

629 views
Skip to first unread message

Vivian Lee

unread,
Oct 2, 2017, 4:11:59 PM10/2/17
to Rich Seddon, Nexus Users

Hi:

 

I’ve Nexus 3.6.0 installed and trying to enable Docker Anonymous Support.

 

On the repository, I have Force basic authentication set to disable.  When I try connecting to the repository, I get the following errors:

 

$ docker login repomgr.tsl.telus.com:19901

Username: z123456

Password:

Error response from daemon: Get https://repomgr.tsl.telus.com:19901/v2/: Get http://repomgr.tsl.telus.com:19901/v2/token?account=z123456&client_id=docker&offline_token=true&service=http%3A%2F%2Frepomgr.tsl.telus.com%3A19901%2Ftoken: EOF

 

$ docker search repomgr.tsl.telus.com:19901/ubuntu

Error response from daemon: Unexpected status code 401

 

Did I miss something in the configuration?

 

 

Vivian

 

 

 

Joseph Stephens

unread,
Oct 2, 2017, 4:25:26 PM10/2/17
to Vivian Lee, Rich Seddon, Nexus Users
Hi Vivian,

Have you added the "Docker Bearer Token Realm"? More information about managing realms can be found here: https://help.sonatype.com/pages/viewpage.action?pageId=330046#Security-Realms 

Thanks,

Joe

--
You received this message because you are subscribed to the Google Groups "Nexus Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users+unsubscribe@glists.sonatype.com.
To post to this group, send email to nexus...@glists.sonatype.com.
To view this discussion on the web visit https://groups.google.com/a/glists.sonatype.com/d/msgid/nexus-users/a6c7bff97440475ca1d66d07400a332e%40BTWP000348.corp.ads.
For more options, visit https://groups.google.com/a/glists.sonatype.com/d/optout.



--
Joseph Stephens

Vivian Lee

unread,
Oct 2, 2017, 4:26:33 PM10/2/17
to Joseph Stephens, Rich Seddon, Nexus Users

Yes, I have.

 

From: Joseph Stephens [mailto:jste...@sonatype.com]
Sent: October 2, 2017 01:25 PM
To: Vivian Lee
Cc: Rich Seddon; Nexus Users
Subject: Re: Nexus 3.6.0 Enabling Docker Anonymous Support

 

Hi Vivian,

 

Have you added the "Docker Bearer Token Realm"? More information about managing realms can be found here: https://help.sonatype.com/pages/viewpage.action?pageId=330046#Security-Realms 

 

Thanks,

 

Joe

On Mon, Oct 2, 2017 at 5:11 PM, Vivian Lee <Vivia...@telus.com> wrote:

Hi:

 

I’ve Nexus 3.6.0 installed and trying to enable Docker Anonymous Support.

 

On the repository, I have Force basic authentication set to disable.  When I try connecting to the repository, I get the following errors:

 

$ docker login repomgr.tsl.telus.com:19901

Username: z123456

Password:

Error response from daemon: Get https://repomgr.tsl.telus.com:19901/v2/: Get http://repomgr.tsl.telus.com:19901/v2/token?account=z123456&client_id=docker&offline_token=true&service=http%3A%2F%2Frepomgr.tsl.telus.com%3A19901%2Ftoken: EOF

 

$ docker search repomgr.tsl.telus.com:19901/ubuntu

Error response from daemon: Unexpected status code 401

 

Did I miss something in the configuration?

 

 

Vivian

 

 

 

--

You received this message because you are subscribed to the Google Groups "Nexus Users" group.

To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users...@glists.sonatype.com.



 

--

Joseph Stephens

Joseph Stephens

unread,
Oct 2, 2017, 4:45:40 PM10/2/17
to Vivian Lee, Rich Seddon, Nexus Users
Another thing to check is that the anonymous user is enabled and has the required privileges: https://help.sonatype.com/pages/viewpage.action?pageId=330046#Security-AnonymousAccess

If so and you still have an issue then could you file a Jira ticket at https://issues.sonatype.org and include a support Zip and also the contents of the following curl request:


(To generate a support ZIP follow the documentation here https://help.sonatype.com/display/NXRM3/Configuration#Configuration-CreatingaSupportZIP)

Thanks,

Joe




--

To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users+unsubscribe@glists.sonatype.com.



 

--

Joseph Stephens




--
Joseph Stephens

Vivian Lee

unread,
Oct 2, 2017, 5:10:32 PM10/2/17
to Joseph Stephens, Rich Seddon, Nexus Users

Enabling is not the issue.  The issue is that when it is enabled, I can no longer login with an account and no longer push to the repository.

 

What did I miss?

 

 

Vivian

--

To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users...@glists.sonatype.com.



 

--

Joseph Stephens



 

--

Joseph Stephens

Joseph Stephens

unread,
Oct 2, 2017, 6:01:22 PM10/2/17
to Vivian Lee, Rich Seddon, Nexus Users
I see what you are saying. Is it possible for you to ssh into the box that Nexus is running on, and to try running the command there? 

Do you see anything in your Nexus request.log related to the token request? If you file a Jira ticket with the support.zip I will take a look for you.


--

To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users+unsubscribe@glists.sonatype.com.



 

--

Joseph Stephens



 

--

Joseph Stephens




--
Joseph Stephens

Peter Lynch

unread,
Oct 3, 2017, 7:45:23 AM10/3/17
to Vivian Lee, Rich Seddon, Nexus Users
On Mon, Oct 2, 2017 at 5:11 PM, Vivian Lee <Vivia...@telus.com> wrote:

Hi:

 

I’ve Nexus 3.6.0 installed and trying to enable Docker Anonymous Support.

 

On the repository, I have Force basic authentication set to disable.   When I try connecting to the repository, I get the following errors:

 

$ docker login repomgr.tsl.telus.com:19901

Username: z123456

Password:

Error response from daemon: Get https://repomgr.tsl.telus.com:19901/v2/: Get http://repomgr.tsl.telus.com:19901/v2/token?account=z123456&client_id=docker&offline_token=true&service=http%3A%2F%2Frepomgr.tsl.telus.com%3A19901%2Ftoken: EOF


This doesn't look right. The URL changed from https to http, and when you see "EOF" it implies that port 19901 is communicating with plain http. HTTPS is required.

This looks like something to do with how you configured port 19901. Did you make that the https port for the docker repository inside Nexus, or do you have a reverse proxy in front of Nexus that is listening with https on that port?


 

$ docker search repomgr.tsl.telus.com:19901/ubuntu

Error response from daemon: Unexpected status code 401

 

Did I miss something in the configuration?

 

 

Vivian

 

 

 

--

Vivian Lee

unread,
Oct 3, 2017, 1:41:35 PM10/3/17
to Peter Lynch, Rich Seddon, Nexus Users

Peter:

Thank you for following up.

I’m able to login and push after I check the Force basic authentication option in the repository configuration, i.e. revert it back to the previous state.

 Is this by designed?

  

Vivian

 

From: Peter Lynch [mailto:ply...@sonatype.com]
Sent: October 3, 2017 04:45 AM
To: Vivian Lee
Cc: Rich Seddon; Nexus Users
Subject: Re: Nexus 3.6.0 Enabling Docker Anonymous Support

 

 

 

On Mon, Oct 2, 2017 at 5:11 PM, Vivian Lee <Vivia...@telus.com> wrote:

Hi:

 

I’ve Nexus 3.6.0 installed and trying to enable Docker Anonymous Support.

 

On the repository, I have Force basic authentication set to disable.   When I try connecting to the repository, I get the following errors:

 

$ docker login repomgr.tsl.telus.com:19901

Username: z123456

Password:

Error response from daemon: Get https://repomgr.tsl.telus.com:19901/v2/: Get http://repomgr.tsl.telus.com:19901/v2/token?account=z123456&client_id=docker&offline_token=true&service=http%3A%2F%2Frepomgr.tsl.telus.com%3A19901%2Ftoken: EOF

 

This doesn't look right. The URL changed from https to http, and when you see "EOF" it implies that port 19901 is communicating with plain http. HTTPS is required.

 

This looks like something to do with how you configured port 19901. Did you make that the https port for the docker repository inside Nexus, or do you have a reverse proxy in front of Nexus that is listening with https on that port?

 

 

 

$ docker search repomgr.tsl.telus.com:19901/ubuntu

Error response from daemon: Unexpected status code 401

 

Did I miss something in the configuration?

 

 

Vivian

 

 

 

--

You received this message because you are subscribed to the Google Groups "Nexus Users" group.

To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users...@glists.sonatype.com.

Peter Lynch

unread,
Oct 3, 2017, 2:01:56 PM10/3/17
to Vivian Lee, Rich Seddon, Nexus Users
Hi Vivian,

It seems to me something else is going wrong.

Can you please reproduce the issue and open a support ticket at https://support.sonatype.com with a nexus support zip attached?

-Peter

--

To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users+unsubscribe@glists.sonatype.com.

Jeffrey Su

unread,
Mar 16, 2018, 1:26:41 PM3/16/18
to Nexus Users, rse...@sonatype.com
Hi Joseph is there a API endpoint to add the Docker Bearer Token Realm? Im trying to do everything via APIs so when my nexus comes up its 100% ready to use.

Joseph Stephens

unread,
Mar 16, 2018, 3:22:15 PM3/16/18
to Jeffrey Su, Nexus Users, Rich Seddon
Hi Jeffrey,

I don't believe there is an API for doing this directly but you could use the scripting API and add a Groovy script that calls RealmManager.enableRealm(). The name of the realm is "DockerToken".

For more information about the scripting API see https://help.sonatype.com/display/NXRM3/Script+API

Thanks,

Joe


--
You received this message because you are subscribed to the Google Groups "Nexus Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users+unsubscribe@glists.sonatype.com.
To post to this group, send email to nexus...@glists.sonatype.com.
To view this discussion on the web visit https://groups.google.com/a/glists.sonatype.com/d/msgid/nexus-users/9e463b60-d3d3-427b-9bd3-6912672a7eb2%40glists.sonatype.com.



--
Joseph Stephens

Danny Kulchinsky

unread,
Mar 16, 2018, 3:26:01 PM3/16/18
to Joseph Stephens, Jeffrey Su, Nexus Users, Rich Seddon
You can see an example of how this is implemented in the Nexus Ansible playbook.



Danny

To view this discussion on the web visit https://groups.google.com/a/glists.sonatype.com/d/msgid/nexus-users/CABs6fL_e4H5eMiijh47JGa2efC1e91-SRpx%3Dgu6yyQEvLmCyMw%40mail.gmail.com.

Jeffrey Su

unread,
Mar 16, 2018, 5:45:34 PM3/16/18
to Danny Kulchinsky, Joseph Stephens, Nexus Users, Rich Seddon
Thanks this helped! Is there a function to change anon to docker bearer token?

Danny Kulchinsky

unread,
Mar 16, 2018, 5:48:02 PM3/16/18
to Jeffrey Su, Joseph Stephens, Nexus Users, Rich Seddon

Jeffrey Su

unread,
Mar 16, 2018, 6:00:51 PM3/16/18
to Danny Kulchinsky, Joseph Stephens, Nexus Users, Rich Seddon
I actually mean the anonymous settings page for nexus. Theres a dropdown to select the realm

Danny Kulchinsky

unread,
Mar 16, 2018, 6:04:25 PM3/16/18
to Jeffrey Su, Joseph Stephens, Nexus Users, Rich Seddon
I see, in my case I just enable/disable it with this:

I don't actually change the anonymouser user name or it's realm, and you don't need to do it to allow Docker anonymous pull, just make sure it's enabled.

Danny

Jeffrey Su

unread,
Mar 16, 2018, 6:07:32 PM3/16/18
to Danny Kulchinsky, Joseph Stephens, Nexus Users, Rich Seddon
Ah gotcha. that works for me as well. Thank you!!
Reply all
Reply to author
Forward
0 new messages