Access token generated from the "User Profile" will not work with npm and mvn install

[andreygrano]

Describe the bug
When using the Access Token that was created from the User Profile in the JFrog CLI configuration the npm and mvn install will fail with the "received invalid access-token" error.

To Reproduce
Login to Artifactory as admin user
Refer to "Edit profile" in Artifactory UI
Generate An Identity Token
Copy the token and use in the JFrog CLI configuration
Test the connection to Artifactory: jf rt ping which will return OK
Create a remote npm repositry to https://registry.npmjs.org (default)
Configure the JFrog CLI to work with npm remote repository
Run npm install of any package, for example:
jf npmi prop-types
similar reproduction steps for jf mvn install, configure Artifactory to work with remote maven repository and run jf mvn install

Expected behavior
jf npm/mvn install will work as expected when using the Access Token generated from the user profile

Screenshots

Versions

• JFrog CLI version: 2.19.0 2.18.2
• Artifactory Version: 7.39.4 7.38.10

Workaround
When using one of the following methods when configuring JFrog CLI to work with Artifactory the npm and mvn install will work as expected:

1. Username + Password / API key
2. Access token generated in Administration -> User management -> Access Tokens

[SharonSbo]

@yahavi
shared a workaround on another issue that seems helpful for this one as well:
LINK

[ventsyv]

Similar problem with docker push.
Both "jf rt dp" and "jf docker push" formats return an error indicating an invalid token.

Also, unlike "jf rt dp" version of the command, "docker push" does not provide --user, --password, and --access_token options. I think those options should be added to "docker push" and they should override the config.

[sverdlov93]

Hi @andreygrano @SharonSbo @ventsyv
Unfortunately, Identity/Reference tokens are currently not supported by JFrog CLI package manager commands because they need a username in addition to the token.
We improved the error log for the above situation.
You can use:

• JFrog Access Token
• User + Password
• set the Reference/Identity Token as a password ( supported by Saas Artifactory 7.42.0 / onPrem Artifactory 7.43.0, on earlier versions use the following workaround - Cannot use Identity token as Password using JFrog CLI #1616 (comment).

[sverdlov93]

Hi @andreygrano and @SharonSbo
JFrog CLI 2.26.2 is released and should fix the above issue with npm.
Looking forward to your feedback on it.

[lannonbr]

So I am using a self-hosted version of Artifactory (7.63.5) and I am still running into issues with this. I'm not using the jfrog cli but rather npm directly and trying to authenticate using the base64 encoded identity token:

Here's my .npmrc (with various fields / credentials redacted)

@<scope>:registry=https://<url>/artifactory/api/npm/<npm_repo>/
//<url>/artifactory/api/npm/<npm_repo>/:_password=<base64_encoded_identity_token>
//<url>/artifactory/api/npm/<npm_repo>/:username=<username>
//<url>/artifactory/api/npm/<npm_repo>/:email=<email>
//<url>/artifactory/api/npm/<npm_repo>/:always-auth=true

I try the same exact thing with the APIKey and replace that _password field and it functions as expected.

@sverdlov93 Is their a plan to support identity tokens here / if it is already supported, documentation on how to use it with npm?