You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "mbertolina (via GitHub)" <gi...@apache.org> on 2026/10/21 20:42:00 UTC
[I] Support for HTTP Basic Authentication when registering templates or ISOs from HTTPS URLs [cloudstack]
mbertolina opened a new issue, #14461:
URL: https://github.com/apache/cloudstack/issues/14461
### The required feature described as a wish
##### ISSUE TYPE
<!-- Pick one below and delete the rest -->
* Feature Idea
* Enhancement Request
##### COMPONENT NAME
<!--
Categorize the issue, e.g. API, UI, templates, secondary storage, etc.
-->
~~~
Templates / ISOs / URL-based registration / Secondary Storage
~~~
##### CLOUDSTACK VERSION
<!--
New line separated list of affected versions, commit ID for issues on main branch.
-->
~~~
All versions
~~~
##### CONFIGURATION
<!--
Information about the configuration if relevant, e.g. advanced networking, etc. N/A otherwise
-->
~~~
N/A
~~~
##### OS / ENVIRONMENT
<!--
Information about the environment if relevant, N/A otherwise
-->
~~~
N/A
~~~
##### SUMMARY
<!-- Explain the problem/feature briefly -->
The CloudStack template and ISO registration flow supports downloads from remote URLs, but it does not currently provide a mechanism to authenticate to protected HTTPS endpoints that require HTTP Basic Authentication.
This limits the ability to register templates and ISOs from secure artifact repositories such as JFrog Artifactory, Nexus, or similar services that require a username and password before the artifact can be retrieved.
##### DESCRIPTION
CloudStack should support authenticated URL-based downloads when registering templates or ISOs. In particular, the registration flow should allow a user to provide credentials for HTTPS endpoints that require HTTP Basic Authentication.
At present, the system does not expose a standard mechanism to pass a username and password during URL-based template/ISO registration. As a result, authenticated remote sources cannot be used directly and users are forced to make those resources publicly accessible or use unsupported external workarounds.
This is a common requirement in enterprise environments where artifacts are stored in private repositories and are exposed only through authenticated HTTP endpoints.
##### EXPECTED RESULTS
<!-- What did you expect to happen when running the steps above? -->
~~~
The CloudStack UI and API should allow template and ISO registration from HTTPS URLs that require HTTP Basic Authentication.
The feature should support providing:
- username
- password
- optional authentication metadata if required by the backend
and should permit successful download of the artifact when valid credentials are supplied.
~~~
##### ACTUAL RESULTS
<!-- What actually happened? -->
~~~
The download fails because CloudStack does not provide a way to pass credentials to the HTTP endpoint. The operation typically fails with authentication errors such as HTTP 401 Unauthorized or equivalent download failures.
```
<!--
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release and main branch are affected too.
Always add information AFTER of these HTML comments, but no need to delete the comments.
-->
##### ISSUE TYPE
<!-- Pick one below and delete the rest -->
* Feature Idea
* Enhancement Request
##### COMPONENT NAME
<!--
Categorize the issue, e.g. API, UI, templates, secondary storage, etc.
-->
~~~
Templates / ISOs / URL-based registration / Secondary Storage
~~~
##### CLOUDSTACK VERSION
<!--
New line separated list of affected versions, commit ID for issues on main branch.
-->
~~~
All versions
~~~
##### CONFIGURATION
<!--
Information about the configuration if relevant, e.g. advanced networking, etc. N/A otherwise
-->
~~~
N/A
~~~
##### OS / ENVIRONMENT
<!--
Information about the environment if relevant, N/A otherwise
-->
~~~
N/A
~~~
##### SUMMARY
<!-- Explain the problem/feature briefly -->
The CloudStack template and ISO registration flow supports downloads from remote URLs, but it does not currently provide a mechanism to authenticate to protected HTTPS endpoints that require HTTP Basic Authentication.
This limits the ability to register templates and ISOs from secure artifact repositories such as JFrog Artifactory, Nexus, or similar services that require a username and password before the artifact can be retrieved.
##### DESCRIPTION
CloudStack should support authenticated URL-based downloads when registering templates or ISOs. In particular, the registration flow should allow a user to provide credentials for HTTPS endpoints that require HTTP Basic Authentication.
At present, the system does not expose a standard mechanism to pass a username and password during URL-based template/ISO registration. As a result, authenticated remote sources cannot be used directly and users are forced to make those resources publicly accessible or use unsupported external workarounds.
This is a common requirement in enterprise environments where artifacts are stored in private repositories and are exposed only through authenticated HTTP endpoints.
##### EXPECTED RESULTS
<!-- What did you expect to happen when running the steps above? -->
~~~
The CloudStack UI and API should allow template and ISO registration from HTTPS URLs that require HTTP Basic Authentication.
The feature should support providing:
- username
- password
- optional authentication metadata if required by the backend
and should permit successful download of the artifact when valid credentials are supplied.
~~~
##### ACTUAL RESULTS
<!-- What actually happened? -->
~~~
The download fails because CloudStack does not provide a way to pass credentials to the HTTP endpoint. The operation typically fails with authentication errors such as HTTP 401 Unauthorized or equivalent download failures.
~~~
##### STEPS TO REPRODUCE
<!--
For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used.
-->
~~~
1. Configure an HTTPS endpoint that requires HTTP Basic Authentication.
2. Store an ISO or template file behind that endpoint.
3. Attempt to register the ISO or template using the CloudStack URL-based registration flow.
4. Observe that the request fails because no username/password is supplied.
~~~
##### PROPOSED SOLUTION
<!-- Describe the desired feature or behavior -->
~~~
Add support for HTTP Basic Authentication in the template/ISO URL registration flow.
The solution may include:
- username and password fields in the UI
- API parameters for authenticated downloads
- validation of credentials during the source fetch
- support for private repositories such as JFrog Artifactory
~~~
##### IMPACT
<!-- Why this matters -->
~~~
This feature is required for secure enterprise deployment practices. It enables CloudStack to consume artifacts from private, authenticated repositories without exposing those artifacts publicly or relying on unsupported manual workarounds.
~~~
```
~~~
##### PROPOSED SOLUTION
<!-- Describe the desired feature or behavior -->
~~~
Add support for HTTP Basic Authentication in the template/ISO URL registration flow.
The solution may include:
- username and password fields in the UI
- API parameters for authenticated downloads
- validation of credentials during the source fetch
- support for private repositories such as JFrog Artifactory
~~~
##### IMPACT
<!-- Why this matters -->
~~~
This feature is required for secure enterprise deployment practices. It enables CloudStack to consume artifacts from private, authenticated repositories without exposing those artifacts publicly or relying on unsupported manual workarounds.
~~~
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org