Jenkins Proxy with Basic Authentication fails to tunnel HTTPS connections

Article ID:360052864931
2 minute readKnowledge base

Issue

CloudBees CI is configured to work with a proxy under Manage Jenkins  System  HTTP Proxy Configuration (previously Manage Jenkins  Manage Plugins  Advanced tab) and Basic authentication is provided with corresponded username / password.

  • After we click on the Check now button to get the updates, a stacktrace similar to the one below is shown in the GUI.

    2020-09-25 10:13:00.023+0000 [id=529]	INFO	hudson.util.Retrier#start: The attempt #1 to do the action check updates server failed with an allowed exception:
java.io.IOException: Unable to tunnel through proxy. Proxy returns "HTTP/1.1 407 Proxy Authentication Required"
	at sun.net.www.protocol.http.HttpURLConnection.doTunneling(HttpURLConnection.java:2124)
	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:183)
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1546)
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1474)
	at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)
	at com.cloudbees.jenkins.plugins.license.nectar.CloudBeesUpdateSite.loadJSON(CloudBeesUpdateSite.java:539)
	at com.cloudbees.jenkins.plugins.license.nectar.CloudBeesUpdateSite.updateDirectlyNow(CloudBeesUpdateSite.java:529)

  • More generally

  • connections to http:// URLs are working through the proxy

  • connections to https:// URLs are failing through the proxy

Environment

Explanation

Jenkins proxy configuration uses HTTP CONNECT to tunnel connections through the the proxy.

Since the release of Java 1.8.0_111-b14, the Basic authentication scheme is disabled by default when tunnelling HTTPS connection with HTTP Connect method to address CVE-2016-5597. And system properties such as jdk.http.auth.tunneling.disabledSchemes have been provided to control the list of disabled scheme for such scenario. As mentioned in the release note:

In some environments, certain authentication schemes may be undesirable when proxying HTTPS. Accordingly, the Basic authentication scheme has been deactivated, by default, in the Oracle Java Runtime, by adding Basic to the jdk.http.auth.tunneling.disabledSchemes networking property. Now, proxies requiring Basic authentication when setting up a tunnel for HTTPS will no longer succeed by default. If required, this authentication scheme can be reactivated by removing Basic from the jdk.http.auth.tunneling.disabledSchemes networking property, or by setting a system property of the same name to "" ( empty ) on the command line.

Additionally, the jdk.http.auth.tunneling.disabledSchemes and jdk.http.auth.proxying.disabledSchemes networking properties, and system properties of the same name, can be used to disable other authentication schemes that may be active when setting up a tunnel for HTTPS, or proxying plain HTTP, respectively.

— https://www.oracle.com/java/technologies/javase/8u111-relnotes.html

Consequently, if using the Jenkins proxy configuration with Basic authentication, requests to HTTPS URLs fail - with generally an HTTP error code 407 as the proxy authorization details will not be sent trough. System properties must be added to make it work.

Resolution

As per the release notes of Java 1.8.0_111-b14, the solution / workaround is to add the system property -Djdk.http.auth.tunneling.disabledSchemes="" on Jenkins startup. See How to add Java arguments to Jenkins?.

Under certain unknown circumstances, it might also needed to add -Dhttp.auth.preference="basic" as well to fully workaround this issue.

References