extension-repository-http: implemented HTTP proxy authentification.

[nE0sIghT]

HttpClientBuilder.useSystemProperties method do not takes into account login and password for authentification against proxy.
This change allows to use http.proxyUser and http.proxyPassword JVM system properties to authentificate against proxy server.

[tmortagne]

This looks like a bug on HTTPClient side to me.

[vmassol]

Why do you say a bug thomas? The doc at http://hc.apache.org/httpcomponents-client-ga/httpclient/apidocs/org/apache/http/impl/client/HttpClientBuilder.html clearly lists what it handles and http.proxyPassword and http.proxyUser are not listed. Could be an improvement (although they may have not supported them voluntarily by default) but I don't see why it would be a bug.

[vmassol]

Also, even if it were a bug, we still need to work around it.

[tmortagne]

I say a bug because it does not make much sense for useSystemProperties() to not handled something as standard as http.proxyUser and http.proxyPassword. IMO they were just forgotten and should be reported, if it was on purpose there would be a note about those two properties in the documentation.

[tmortagne]

Thanks for the contribution @nE0sIghT by the way but I would like to understand why HTTPClient does not support this in the first place before reimplementing on our side the proxy. Also note that this workaround only works for HTTP and not HTTPS proxy from what I understand (at least the standard properties for https are supposed to be https.proxyUser and https.proxyPassword)

[nE0sIghT]

To say the truth http.proxy(User|Password) never was some standard as I know.
Java documentation only says about http.proxyHost, http.proxyPort and http.nonProxyHosts.
For an example, Liferay uses com.liferay.portal.util.HttpImpl.proxy.(username|password).

I do not think this must be fixed in commons HTTP client.

[tmortagne]

Java documentation only says about http.proxyHost, http.proxyPort and http.nonProxyHosts.

It also talk about https.proxyHost and https.proxyPort.

For proxyUser the closest from a standard documentation I could find is http://www.ibm.com/support/knowledgecenter/was_beta/com.ibm.websphere.base.doc/ae/twbs_configwbsclient2webproxy.html which is also talking about http.* vs https.*.

[tmortagne]

Seems to me setting the right credential provider should be enough. Setting the proxy is supposed to be useSystemProperties() job, then it will ask the credential provider if it needs authentication.

[nE0sIghT]

Agreed. However we need to construct proxy HttpHost object to pass it to credential provider.
This part is not clear for me if auto detected system proxy used.
I think the proper way is to extract all auto detected system proxies (as commons HTTP client do it) and set credentials for each of them.

[tmortagne]

A much simpler alternative to all that might be to just set a default java.net.Authenticator which return whatever is indicated in http.proxyUser/Pass if called with RequestorType.PROXY. But probably in a different module since it will apply to everything so that you can get rid of it if you want to provide a different one for your setup.

Others had this idea. For inspiration on how to implement it: https://svn.apache.org/repos/asf/ant/ivy/core/trunk/src/java/org/apache/ivy/util/url/IvyAuthenticator.java

[nE0sIghT]

Looks nice! I think this is a best method.

[sdumitriu]

Check out https://github.com/phenotips/phenotips/tree/master/components/proxy-authentication

[nE0sIghT]

@sdumitriu
As I see this implementation wil reveal proxy login/password to any website. At least getRequestorType method should be used.

[sdumitriu]

@nE0sIghT True, but the example is how this could be accomplished globally, not just for extension-repository-http, and in a manner that doesn't add complexity. The authenticator itself is as simple as possible, and it should indeed check the authenticator type, and could be extended to take into account different http and https settings.

[tmortagne]

Yep this is a good illustration of what I was talking about, plus it's already XWiki style :)

But this one is missing a few things IMO:

• it should wrap any pre existing default Authenticator (and put it back in the dispose() of the listener probably)
• it should return the login/password only if the type is PROXY, otherwise fallback on wrapped Authenticator
• it should also support https.proxyUser/Passwor IMO since I saw several mentions of this around (and they make sense anyway since that's how proxy host and ports are working too)