CODEWITHSUNDEEP
mavenarchiva
Sam Levin
Sam Levin

Reputation: 3416

How to force authentication to Archiva internal repository?

big problem. My Archiva internal repo (and maybe snapshot repo, although I don't know yet as I have not put any snapshots in there yet) seem to be accessible to the public.

I.e. if someone wanted the surefire plugin from my repo, they could download it by simply going to https://my.repo.url.com/archiva/repository/internal/org/apache/maven/surefire/surefire-junit3/2.7.1/surefire-junit3-2.7.1.jar

They could download the file right then and there. Would be a shame if there were actual project jar's and such in there also available to the general public and I can't seem to figure out how to disable private access to save the life of me.

I authenticate via LDAP.

Thanks!

Upvotes: 3

Views: 2409

Answers (2)

Brett Porter
Brett Porter

Reputation: 5867

To expand on Raghuram's answer, you should consider using different managed repositories for your own releases, as opposed to those proxied from an internet repository (as internal is configured to do by default).

Part of the confusion here is the legacy name of internal, which no longer accurately represents its meaning.

Upvotes: 2

Raghuram
Raghuram

Reputation: 52645

One possibility is you have a guest user, which has the repository observer role. You can either remove the user or disable the role. There is an FAQ which asks for the opposite of what you need.

Upvotes: 2

Related Questions