Introduction
Recently, NPM introduced a breaking change in which the legacy authentication types have been consolidated into “legacy”, making the auth-type default to “web”.
More information can be found in NPM's official release notes and this JFrog Jira ticket.
Artifactory version 7.52 has introduced support for the Web login method. Artifactory should be upgraded to allow npm login using the Web login mechanism.
Users authenticating with the npm login command:
Due to the change, and as a workaround, it is required to add a flag when performing the npm login against Artifactory. NPM clients running on versions earlier than 9 will use the same authentication command as previously:
$ npm login
Users working with npm version 9 will need to add the --auth-type=legacy flag in order to perform the login, setting the authentication type to “legacy”:
$ npm login --auth-type=legacy
Attempts to run the npm login without the flag will result in the following error:
npm ERR! code ENYI
npm ERR! Web login not supported
npm ERR! A complete log of this run can be found in:
npm ERR! /root/.npm/_logs/2022-11-16T11_59_45_230Z-debug-0.log
Users authenticating using the .npmrc file:
Users may authenticate using the .npmrc snippet available in the “Set Me Up” section of the repository. In this case, the configuration snippet that Artifactory generates is no longer valid. The configuration snippet will look similar to this:
registry=https://<JF_URL>.jfrog/artifactory/api/npm/dev-npm/
_auth=<USER>:<PASSWORD> (converted to base 64)
email=youremail@email.com
Attempts to install npm packages while authenticated with the above configuration will result in the following error:
npm ERR! code ERR_INVALID_AUTH
npm ERR! Invalid auth configuration found: `_auth` must be renamed to
`//<JF_URL>.jfrog/artifactory/api/npm/dev-npm/:_auth` in user config
npm ERR! Please run `npm config fix` to repair your configuration.
npm ERR! A complete log of this run can be found in:
npm ERR! /root/.npm/_logs/2022-11-16T12_02_05_084Z-debug-0.log
Running npm config fix will repair the configuration and update it to use the new format, in which the _auth information is no longer presented in a separate line, but is now part of the URL as follows:
email=user@t.com
registry=https://<JF_URL>.jfrog/artifactory/api/npm/dev-npm/
//<JF_URL>.jfrog/artifactory/api/npm/dev-npm/:_auth=<base_64_user:password>
Important:
Manually delete always-auth=true from your .npmrc file if present. This flag was deprecated in npm v7 and removed in modern versions. Leaving it in your configuration will trigger ERR_UNKNOWN_CONFIG or configuration warnings in npm v9.
The .npmrc snippet can also be retrieved by running a cURL request to the following endpoint:
$ curl https://ART_HOST/artifactory/api/npm/auth
Note:
Users who are already logged in are not affected.
References & Related Links