mbertolina opened a new issue, #14461:
URL: https://github.com/apache/cloudstack/issues/14461
### The required feature described as a wish
##### ISSUE TYPE
<!-- Pick one below and delete the rest -->
* Feature Idea
* Enhancement Request
##### COMPONENT NAME
<!--
Categorize the issue, e.g. API, UI, templates, secondary storage, etc.
-->
~~~
Templates / ISOs / URL-based registration / Secondary Storage
~~~
##### CLOUDSTACK VERSION
<!--
New line separated list of affected versions, commit ID for issues on main
branch.
-->
~~~
All versions
~~~
##### CONFIGURATION
<!--
Information about the configuration if relevant, e.g. advanced networking,
etc. N/A otherwise
-->
~~~
N/A
~~~
##### OS / ENVIRONMENT
<!--
Information about the environment if relevant, N/A otherwise
-->
~~~
N/A
~~~
##### SUMMARY
<!-- Explain the problem/feature briefly -->
The CloudStack template and ISO registration flow supports downloads from
remote URLs, but it does not currently provide a mechanism to authenticate to
protected HTTPS endpoints that require HTTP Basic Authentication.
This limits the ability to register templates and ISOs from secure artifact
repositories such as JFrog Artifactory, Nexus, or similar services that require
a username and password before the artifact can be retrieved.
##### DESCRIPTION
CloudStack should support authenticated URL-based downloads when registering
templates or ISOs. In particular, the registration flow should allow a user to
provide credentials for HTTPS endpoints that require HTTP Basic Authentication.
At present, the system does not expose a standard mechanism to pass a
username and password during URL-based template/ISO registration. As a result,
authenticated remote sources cannot be used directly and users are forced to
make those resources publicly accessible or use unsupported external
workarounds.
This is a common requirement in enterprise environments where artifacts are
stored in private repositories and are exposed only through authenticated HTTP
endpoints.
##### EXPECTED RESULTS
<!-- What did you expect to happen when running the steps above? -->
~~~
The CloudStack UI and API should allow template and ISO registration from
HTTPS URLs that require HTTP Basic Authentication.
The feature should support providing:
- username
- password
- optional authentication metadata if required by the backend
and should permit successful download of the artifact when valid credentials
are supplied.
~~~
##### ACTUAL RESULTS
<!-- What actually happened? -->
~~~
The download fails because CloudStack does not provide a way to pass
credentials to the HTTP endpoint. The operation typically fails with
authentication errors such as HTTP 401 Unauthorized or equivalent download
failures.
```
<!--
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release and main branch are affected too.
Always add information AFTER of these HTML comments, but no need to delete
the comments.
-->
##### ISSUE TYPE
<!-- Pick one below and delete the rest -->
* Feature Idea
* Enhancement Request
##### COMPONENT NAME
<!--
Categorize the issue, e.g. API, UI, templates, secondary storage, etc.
-->
~~~
Templates / ISOs / URL-based registration / Secondary Storage
~~~
##### CLOUDSTACK VERSION
<!--
New line separated list of affected versions, commit ID for issues on main
branch.
-->
~~~
All versions
~~~
##### CONFIGURATION
<!--
Information about the configuration if relevant, e.g. advanced networking,
etc. N/A otherwise
-->
~~~
N/A
~~~
##### OS / ENVIRONMENT
<!--
Information about the environment if relevant, N/A otherwise
-->
~~~
N/A
~~~
##### SUMMARY
<!-- Explain the problem/feature briefly -->
The CloudStack template and ISO registration flow supports downloads from
remote URLs, but it does not currently provide a mechanism to authenticate to
protected HTTPS endpoints that require HTTP Basic Authentication.
This limits the ability to register templates and ISOs from secure artifact
repositories such as JFrog Artifactory, Nexus, or similar services that require
a username and password before the artifact can be retrieved.
##### DESCRIPTION
CloudStack should support authenticated URL-based downloads when registering
templates or ISOs. In particular, the registration flow should allow a user to
provide credentials for HTTPS endpoints that require HTTP Basic Authentication.
At present, the system does not expose a standard mechanism to pass a
username and password during URL-based template/ISO registration. As a result,
authenticated remote sources cannot be used directly and users are forced to
make those resources publicly accessible or use unsupported external
workarounds.
This is a common requirement in enterprise environments where artifacts are
stored in private repositories and are exposed only through authenticated HTTP
endpoints.
##### EXPECTED RESULTS
<!-- What did you expect to happen when running the steps above? -->
~~~
The CloudStack UI and API should allow template and ISO registration from
HTTPS URLs that require HTTP Basic Authentication.
The feature should support providing:
- username
- password
- optional authentication metadata if required by the backend
and should permit successful download of the artifact when valid credentials
are supplied.
~~~
##### ACTUAL RESULTS
<!-- What actually happened? -->
~~~
The download fails because CloudStack does not provide a way to pass
credentials to the HTTP endpoint. The operation typically fails with
authentication errors such as HTTP 401 Unauthorized or equivalent download
failures.
~~~
##### STEPS TO REPRODUCE
<!--
For bugs, show exactly how to reproduce the problem, using a minimal
test-case.
For new features, show how the feature would be used.
-->
~~~
1. Configure an HTTPS endpoint that requires HTTP Basic Authentication.
2. Store an ISO or template file behind that endpoint.
3. Attempt to register the ISO or template using the CloudStack URL-based
registration flow.
4. Observe that the request fails because no username/password is supplied.
~~~
##### PROPOSED SOLUTION
<!-- Describe the desired feature or behavior -->
~~~
Add support for HTTP Basic Authentication in the template/ISO URL
registration flow.
The solution may include:
- username and password fields in the UI
- API parameters for authenticated downloads
- validation of credentials during the source fetch
- support for private repositories such as JFrog Artifactory
~~~
##### IMPACT
<!-- Why this matters -->
~~~
This feature is required for secure enterprise deployment practices. It
enables CloudStack to consume artifacts from private, authenticated
repositories without exposing those artifacts publicly or relying on
unsupported manual workarounds.
~~~
```
~~~
##### PROPOSED SOLUTION
<!-- Describe the desired feature or behavior -->
~~~
Add support for HTTP Basic Authentication in the template/ISO URL
registration flow.
The solution may include:
- username and password fields in the UI
- API parameters for authenticated downloads
- validation of credentials during the source fetch
- support for private repositories such as JFrog Artifactory
~~~
##### IMPACT
<!-- Why this matters -->
~~~
This feature is required for secure enterprise deployment practices. It
enables CloudStack to consume artifacts from private, authenticated
repositories without exposing those artifacts publicly or relying on
unsupported manual workarounds.
~~~
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
