Repository: conda/conda

Issue:
Basic access authentification channels broken in 4.1.0
Previously it was possible to have a channel like:

https://user:password@myserver.com

or even have the user and password saved in `.netrc`. conda 4.1.0 and up ignore the credentials and give a 401 error (causing everything to break for users).

```
$ conda install conda=4.1.0
Using Anaconda Cloud api site https://api.anaconda.org
Fetching package metadata ...........Error: HTTPError: 401 Client Error: Unauthorized for url:https://user:password@myserver.com
```

conda=4.1 no longer respects HTTP_PROXY 
My proxy variables are properly set:

```
$ set https_proxy
HTTPS_PROXY=http://myproxy:8080
```

`conda=4.0.8` successfully picks up my `%HTTPS_PROXY%` and installs `conda=4.1`:

```
$ conda install conda=4.1
Fetching package metadata: ..........
Solving package specifications: .........

The following packages will be UPDATED:
    conda:     4.0.8-py27_0 defaults --> 4.1.0-py27_0 defaults
```

now trying to revert back to `conda=4.0`:

```
$ conda install conda=4.0
Fetching package metadata .........
Could not connect to https://repo.continuum.io/pkgs/free/win-64/
Connection error: HTTPSConnectionPool(host='repo.continuum.io', port=443): Max retries exceeded with url...
```

proxy settings no longer work. Configuring `proxy_servers` in `.condarc` restores connectivity.



Discussion:
See this PR that is in 4.1.1. 
https://github.com/conda/conda/pull/2695

We disabled the requests library's use of .netrc. You can set `proxy_servers` in .condarc if you want. 

Besides reverting back to sucking up .netrc by default, how can we make things work best with your setup?

> On Jun 16, 2016, at 2:41 PM, Zaharid notifications@github.com wrote:
> 
> Previously it was possible to have a channel like:
> 
> https://user:password@myserver.com
> 
> or even have the user and password saved in .netrc. conda 4.1.0 and up ignore the credentials and give a 401 error (causing everything to break for users).
> 
> $ conda install conda=4.1.0
> Using Anaconda Cloud api site https://api.anaconda.org
> Fetching package metadata ...........Error: HTTPError: 401 Client Error: Unauthorized for url:https://user:password@myserver.com
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub, or mute the thread.

There is 4.1.0 that disables `.netrc`, but there is something else in 4.1.1 that furthermore disables urls with user and password explicitly in the channel urls (which I don't like very much anyway because the credentials appear in all the logs).

Thinks that could be good for me are:
- Explicit support for basic auth in condarc (since it isn't in .netrc).
- Support for client SSL certificates (which I believe is easy with requests).

Thanks.

> Explicit support for basic auth in condarc 

I'll add this tonight or tomorrow.  Will be in 4.1.2.

> Support for client SSL certificates (which I believe is easy with requests).

Already done. 

```
conda config --set ssl_verify PATH_TO_CERT_BUNDLE
```

The `ssl_verify` parameter is fed directly to requests.  Can either be boolean True/False to verify ssl, or a string with a cert bundle path to verify against.

Can also confirm this. Unfortunately it's not possible to specify no_proxy in the .condarc, so 4.1 is not working if you have a proxy and internal channels.

Thanks for the report, folks; I'm sorry for the trouble here. I'm unfamiliar with the proxy handling code so we'll have to find someone here better equipped. As far as I can tell we've never explicitly checked HTTP_PROXY so I'm guessing that it's caused by `requests` (not blaming that module per se, just saying that we must have changed the way we are using it.) @kalefranz @msarahan any ideas? 

Something like this changed in Conda-build - not sure if it is instructive: https://github.com/conda/conda-build/pull/989

This seems to be a problem with the newer version of requests in conda 4.1.0.

With an HTTPS_PROXY environment variable set:

Using requests 2.9.0:

```
In [1]: import requests
In [2]: requests.get('https://repo.continuum.io/pkgs/free/win-64', timeout=1, verify=False)
C:\Miniconda2_2\lib\site-packages\requests\packages\urllib3\connectionpool.py:791: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html
  InsecureRequestWarning)
Out [2]: <Response [407]>
```

Using requests 2.10.0

```
In [1]: import requests
In [2]: requests.get('https://repo.continuum.io/pkgs/free/win-64', timeout=1, verify=False)
requests\packages\urllib3\connectionpool.py:821: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html
  InsecureRequestWarning)

<.............. times out>
```

The 407 response 'proxy authentication required' might be another clue I guess.

Ah, so I'm not the only one. I created this ticket because I experienced the same thing: https://github.com/conda/conda/issues/2671. This current ticket is more eloquent than mine, so perhaps 2671 can be closed and this can take it's place?

I have experienced the same thing. .condarc works, but env var HTTP_PROXY is not taken into account. conda 4.0.8 was fine in this regard.

I'm looking into this now.  Probably the last bug to fix for today's 4.1.1 release.

Pretty sure this happened when I disabled `~/.netrc` files from requests.  PR https://github.com/conda/conda/pull/2514 in response to issue https://github.com/conda/conda/issues/2161.

The thread here for requests is relevant: https://github.com/kennethreitz/requests/issues/2773

Looks like I should have followed more closely @dsludwig's fix here: https://github.com/Anaconda-Platform/anaconda-client/pull/298


Resolving patch:
diff --git a/conda/connection.py b/conda/connection.py
--- a/conda/connection.py
+++ b/conda/connection.py
@@ -90,8 +90,6 @@ def __init__(self, *args, **kwargs):
         proxies = get_proxy_servers()
         if proxies:
             self.proxies = proxies
-        self.auth = NullAuth()  # disable .netrc file. for reference, see
-                                #   https://github.com/Anaconda-Platform/anaconda-client/pull/298
 
         # Configure retries
         if retries:
@@ -112,22 +110,6 @@ def __init__(self, *args, **kwargs):
 
         self.verify = ssl_verify
 
-
-class NullAuth(requests.auth.AuthBase):
-    '''force requests to ignore the ``.netrc``
-    Some sites do not support regular authentication, but we still
-    want to store credentials in the ``.netrc`` file and submit them
-    as form elements. Without this, requests would otherwise use the
-    .netrc which leads, on some sites, to a 401 error.
-    https://github.com/kennethreitz/requests/issues/2773
-    Use with::
-        requests.get(url, auth=NullAuth())
-    '''
-
-    def __call__(self, r):
-        return r
-
-
 class S3Adapter(requests.adapters.BaseAdapter):
 
     def __init__(self):


Test patch: